Skip to content

Commit

Permalink
mapshape: fix double free bug after error in msSHPReadShape()
Browse files Browse the repository at this point in the history
After freeing the "line" field, we need to clear it, or else it will
be freed again in msFreeShape().

In two code paths, the "numlines" field was not cleared, which could
lead to a use-after-free bug in msFreeShape(), which in turn could
either crash or lead to another double-free bug in msFreeShape().

Vulnerability found with libFuzzer.
  • Loading branch information
MaxKellermann committed Oct 5, 2021
1 parent 89b4448 commit 6fa2243
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions mapshape.c
Original file line number Diff line number Diff line change
Expand Up @@ -1393,6 +1393,7 @@ void msSHPReadShape( SHPHandle psSHP, int hEntity, shapeObj *shape )
while(--i >= 0)
free(shape->line[i].point);
free(shape->line);
shape->line = NULL;
shape->numlines = 0;
shape->type = MS_SHAPE_NULL;
msSetError(MS_MEMERR, "Out of memory", "msSHPReadShape()");
Expand Down Expand Up @@ -1488,6 +1489,8 @@ void msSHPReadShape( SHPHandle psSHP, int hEntity, shapeObj *shape )

if (nPoints < 0 || nPoints > 50 * 1000 * 1000) {
free(shape->line);
shape->line = NULL;
shape->numlines = 0;
shape->type = MS_SHAPE_NULL;
msSetError(MS_SHPERR, "Corrupted .shp file : shape %d, nPoints=%d.",
"msSHPReadShape()", hEntity, nPoints);
Expand All @@ -1499,6 +1502,8 @@ void msSHPReadShape( SHPHandle psSHP, int hEntity, shapeObj *shape )
nRequiredSize += 16 + nPoints * 8;
if (nRequiredSize > nEntitySize) {
free(shape->line);
shape->line = NULL;
shape->numlines = 0;
shape->type = MS_SHAPE_NULL;
msSetError(MS_SHPERR, "Corrupted .shp file : shape %d : nPoints = %d, nEntitySize = %d",
"msSHPReadShape()", hEntity, nPoints, nEntitySize);
Expand All @@ -1510,6 +1515,7 @@ void msSHPReadShape( SHPHandle psSHP, int hEntity, shapeObj *shape )
shape->line[0].point = (pointObj *) malloc( nPoints * sizeof(pointObj) );
if (shape->line[0].point == NULL) {
free(shape->line);
shape->line = NULL;
shape->numlines = 0;
shape->type = MS_SHAPE_NULL;
msSetError(MS_MEMERR, "Out of memory", "msSHPReadShape()");
Expand Down

0 comments on commit 6fa2243

Please sign in to comment.