Permalink
Browse files

check refcount is zero before freeing (fix double free in php mapscript)

  • Loading branch information...
1 parent 99a6f00 commit a9ffaf860eed8c51453437501f70be85e9dab91b @unicolet unicolet committed Jan 29, 2013
Showing with 2 additions and 2 deletions.
  1. +2 −2 mapoutput.c
View
@@ -509,8 +509,8 @@ int msRemoveOutputFormat(mapObj *map, const char *name)
i = msGetOutputFormatIndex(map, name);
if (i >= 0) {
map->numoutputformats--;
- MS_REFCNT_DECR(map->outputformatlist[i]);
- msFreeOutputFormat( map->outputformatlist[i] );
+ if(MS_REFCNT_DECR_IS_ZERO(map->outputformatlist[i]))
+ msFreeOutputFormat( map->outputformatlist[i] );
for (j=i; j<map->numoutputformats-1; j++) {
map->outputformatlist[j] = map->outputformatlist[j+1];

0 comments on commit a9ffaf8

Please sign in to comment.