Permalink
Browse files

Declare nLayerOrder where it's used. (#5387)

If LAYERS is specified multiple times in the query string, nLayerOrder isnt
reset to 0, and this leads to memory corruption/double-free's upon exit.
  • Loading branch information...
landryb authored and tbonfort committed Feb 9, 2017
1 parent 57fa73c commit 132695864b27bb6fced9a866f35365f445889a00
Showing with 1 addition and 1 deletion.
  1. +1 −1 mapwms.c
View
@@ -791,7 +791,6 @@ int msWMSLoadGetMapParams(mapObj *map, int nVersion,
const char *wms_request, owsRequestObj *ows_request)
{
int i, adjust_extent = MS_FALSE, nonsquare_enabled = MS_FALSE;
- int nLayerOrder = 0;
int transparent = MS_NOOVERRIDE;
int bbox_pixel_is_point = MS_FALSE;
outputFormatObj *format = NULL;
@@ -870,6 +869,7 @@ int msWMSLoadGetMapParams(mapObj *map, int nVersion,
if (strcasecmp(names[i], "LAYERS") == 0) {
int j, k, iLayer, *layerOrder;
+ int nLayerOrder = 0;
char ***nestedGroups = NULL;
int *numNestedGroups = NULL;
int *isUsedInNestedGroup = NULL;

0 comments on commit 1326958

Please sign in to comment.