process crash with crafted request #5387

Open
landryb opened this Issue Feb 14, 2017 · 0 comments

Comments

Projects
None yet
1 participant
@landryb
Contributor

landryb commented Feb 14, 2017

While building some regress tests for my mapfile, i wrongly passed twice one of the WMS arguments in the querystring, resulting in pretty bad memory corruptions/double-free on exit. Memory corruptions seems to be random, but happens much more with many layers in the mapfile (34 in my tests).

That's with mapserver 7.0.4 on OpenBSD/amd64, but i also saw this with 6.4.2 and 7.0.4 on Debian Jessie. PR to fix this in a few.

landryb added a commit to landryb/mapserver that referenced this issue Feb 14, 2017

Declare nLayerOrder where it's used. (#5387)
If LAYERS is specified multiple times in the query string, nLayerOrder isnt
reset to 0, and this leads to memory corruption/double-free's upon exit.

tbonfort added a commit that referenced this issue Feb 14, 2017

Declare nLayerOrder where it's used. (#5387)
If LAYERS is specified multiple times in the query string, nLayerOrder isnt
reset to 0, and this leads to memory corruption/double-free's upon exit.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment