Skip to content

Commit

Permalink
msLayerEncodeShapeAttributes(): fix use after free when iconv() fails…
Browse files Browse the repository at this point in the history
… (CID 1174492, 1174493)
  • Loading branch information
rouault committed Apr 23, 2021
1 parent b93a504 commit fe5d523
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions mapstring.cpp
Expand Up @@ -2376,13 +2376,18 @@ int msLayerEncodeShapeAttributes( layerObj *layer, shapeObj *shape) {

bufleft = bufsize;

bool failedIconv = false;
while (len > 0) {
const size_t iconv_status = msIconv(cd, (char**)&inp, &len, &outp, &bufleft);
if(iconv_status == static_cast<size_t>(-1)) {
msFree(out);
continue; /* silently ignore failed conversions */
failedIconv = true;
break;
}
}
if( failedIconv ) {
msFree(out);
continue; /* silently ignore failed conversions */
}
out[bufsize - bufleft] = '\0';
msFree(shape->values[i]);
shape->values[i] = out;
Expand Down

0 comments on commit fe5d523

Please sign in to comment.