Skip to content
  • David Zhao's avatar
    55372356
    Bug#21823135 INVALID READ OF MEMORY FREED BY GIS_WKB_RAW_FREE · 55372356
    David Zhao authored
    Issue:
    
    The cmp_item_string::store_value() doesn't copy the string even if
    value.is_alloced() is false, which means the string buffer referenced by 'value'
    doesn't belong to 'value' but the cmp_item_string simply use this buffer
    anyway, assuming the buffer will be always valid whenever it's accessed.
    This is wrong in itself.
    
    The way some GIS functions work is to return geometry blob buffer allocated
    by Boost.Geometry without duplicating it, and free this buffer next time the
    same function is called. Such behavior breaks above wrong assumption and
    hence the memory issue.
    
    Fix:
    
    In cmp_item_string::store_value(), if 'value' 's referenced buffer was not
    allocated by itself, duplicate its string.
    55372356
    Bug#21823135 INVALID READ OF MEMORY FREED BY GIS_WKB_RAW_FREE
    David Zhao authored
    Issue:
    
    The cmp_item_string::store_value() doesn't copy the string even if
    value.is_alloced() is false, which means the string buffer referenced by 'value'
    doesn't belong to 'value' but the cmp_item_string simply use this buffer
    anyway, assuming the buffer will be always valid whenever it's accessed.
    This is wrong in itself.
    
    The way some GIS functions work is to return geometry blob buffer allocated
    by Boost.Geometry without duplicating it, and free this buffer next time the
    same function is called. Such behavior breaks above wrong assumption and
    hence the memory issue.
    
    Fix:
    
    In cmp_item_string::store_value(), if 'value' 's referenced buffer was not
    allocated by itself, duplicate its string.
Loading