Fix crash on corrupt qix files (#2362)

* Fix crash on corrupt qix files (#2362)
MapServer · Mar 11, 2019 · 7774a79 · 7774a79
1 parent 2ab56ae
commit 7774a79
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 4 deletions.
diff --git a/mapshape.c b/mapshape.c
@@ -1843,7 +1843,7 @@ int msShapefileWhichShapes(shapefileObj *shpfile, rectObj rect, int debug)
 
     sprintf(filename, "%s%s", sourcename, MS_INDEX_EXTENSION);
 
-    shpfile->status = msSearchDiskTree(filename, rect, debug);
+    shpfile->status = msSearchDiskTree(filename, rect, debug, shpfile->numshapes);
     free(filename);
     free(sourcename);
 

diff --git a/maptree.c b/maptree.c
@@ -527,7 +527,7 @@ static void searchDiskTreeNode(SHPTreeHandle disktree, rectObj aoi, ms_bitarray
   return;
 }
 
-ms_bitarray msSearchDiskTree(const char *filename, rectObj aoi, int debug)
+ms_bitarray msSearchDiskTree(const char *filename, rectObj aoi, int debug, int numshapes)
 {
   SHPTreeHandle disktree;
   ms_bitarray status=NULL;
@@ -541,6 +541,12 @@ ms_bitarray msSearchDiskTree(const char *filename, rectObj aoi, int debug)
     return(NULL);
   }
 
+  if (disktree->nShapes != numshapes) {
+      msSetError(MS_SHPERR, "The spatial index file %s is corrupt.", "msSearchDiskTree()", filename);
+      msSHPDiskTreeClose(disktree);
+      return(NULL);
+  }
+
   status = msAllocBitArray(disktree->nShapes);
   if(!status) {
     msSetError(MS_MEMERR, NULL, "msSearchDiskTree()");

diff --git a/maptree.h b/maptree.h
@@ -85,7 +85,7 @@ extern "C" {
   MS_DLL_EXPORT void msDestroyTree(treeObj *tree);
 
   MS_DLL_EXPORT ms_bitarray msSearchTree(const treeObj *tree, rectObj aoi);
-  MS_DLL_EXPORT ms_bitarray msSearchDiskTree(const char *filename, rectObj aoi, int debug);
+  MS_DLL_EXPORT ms_bitarray msSearchDiskTree(const char *filename, rectObj aoi, int debug, int numshapes);
 
   MS_DLL_EXPORT treeObj *msReadTree(char *filename, int debug);
   MS_DLL_EXPORT int msWriteTree(treeObj *tree, char *filename, int LSB_order);

diff --git a/shptreetst.c b/shptreetst.c
@@ -155,7 +155,7 @@ int main( int argc, char ** argv )
     rect.maxy =  node->rect.maxy;
   }
 
-  bitmap = msSearchDiskTree( argv[1], rect, 0 /* no debug*/ );
+  bitmap = msSearchDiskTree( argv[1], rect, 0 /* no debug*/, j );
 
   if ( bitmap ) {
     printf ("result of rectangle search was \n");