Skip to content

process crash with crafted request #5387

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
landryb opened this issue Feb 14, 2017 · 1 comment
Closed

process crash with crafted request #5387

landryb opened this issue Feb 14, 2017 · 1 comment

Comments

@landryb
Copy link
Contributor

landryb commented Feb 14, 2017

While building some regress tests for my mapfile, i wrongly passed twice one of the WMS arguments in the querystring, resulting in pretty bad memory corruptions/double-free on exit. Memory corruptions seems to be random, but happens much more with many layers in the mapfile (34 in my tests).

That's with mapserver 7.0.4 on OpenBSD/amd64, but i also saw this with 6.4.2 and 7.0.4 on Debian Jessie. PR to fix this in a few.
landryb added a commit to landryb/mapserver that referenced this issue Feb 14, 2017
@landryb
Declare nLayerOrder where it's used. (MapServer#5387)
1fd83f6 
If LAYERS is specified multiple times in the query string, nLayerOrder isnt
reset to 0, and this leads to memory corruption/double-free's upon exit.
tbonfort pushed a commit that referenced this issue Feb 14, 2017
@landryb @tbonfort
Declare nLayerOrder where it's used. (#5387)
1326958 
If LAYERS is specified multiple times in the query string, nLayerOrder isnt
reset to 0, and this leads to memory corruption/double-free's upon exit.
@landryb
Copy link
Contributor Author

landryb commented Feb 9, 2022

Fixed by #5388

@landryb landryb closed this as completed Feb 9, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@landryb