Fix use-after-free error in msDrawRasterLayerLowOpenDataset (MapServer#7333)

marisn · web-flow · commit 3c18f7e65732 · 2025-09-29T16:17:25.000+02:00
* Fix use-after-free error in msDrawRasterLayerLowOpenDataset

* A test case for crash on printing raster debug info
diff --git a/msautotest/wxs/wms_raster.map b/msautotest/wxs/wms_raster.map
@@ -31,7 +31,7 @@ IMAGECOLOR 255 255 255
 SHAPEPATH ./data
 SYMBOLSET etc/symbols.sym
 FONTSET etc/fonts.txt
-
+DEBUG 1
 
 #
 # Start of web interface definition
diff --git a/src/mapraster.c b/src/mapraster.c
@@ -651,7 +651,6 @@ void *msDrawRasterLayerLowOpenDataset(mapObj *map, layerObj *layer,
         GDALOpenEx(*p_decrypted_path, GDAL_OF_RASTER | GDAL_OF_SHARED,
                    (const char *const *)papszAllowedDrivers,
                    (const char *const *)connectionoptions, NULL);
-    CSLDestroy(papszAllowedDrivers);
     CSLDestroy(connectionoptions);
 
     // Give a hint about which GDAL driver should be enabled, but only in
@@ -678,6 +677,7 @@ void *msDrawRasterLayerLowOpenDataset(mapObj *map, layerObj *layer,
         }
       }
     }
+    CSLDestroy(papszAllowedDrivers);
     return hDS;
   } else {
     return GDALOpenShared(*p_decrypted_path, GA_ReadOnly);

Original file line number	Diff line number	Diff line change
`@@ -31,7 +31,7 @@ IMAGECOLOR 255 255 255`
`31`	`31`	`SHAPEPATH ./data`
`32`	`32`	`SYMBOLSET etc/symbols.sym`
`33`	`33`	`FONTSET etc/fonts.txt`
`34`		`-`
	`34`	`+DEBUG 1`
`35`	`35`
`36`	`36`	`#`
`37`	`37`	`# Start of web interface definition`
Original file line number	Diff line number	Diff line change
`@@ -651,7 +651,6 @@ void msDrawRasterLayerLowOpenDataset(mapObj map, layerObj *layer,`
`651`	`651`	`GDALOpenEx(*p_decrypted_path, GDAL_OF_RASTER \| GDAL_OF_SHARED,`
`652`	`652`	`(const char const )papszAllowedDrivers,`
`653`	`653`	`(const char const )connectionoptions, NULL);`
`654`		`- CSLDestroy(papszAllowedDrivers);`
`655`	`654`	`CSLDestroy(connectionoptions);`
`656`	`655`
`657`	`656`	`// Give a hint about which GDAL driver should be enabled, but only in`
`@@ -678,6 +677,7 @@ void msDrawRasterLayerLowOpenDataset(mapObj map, layerObj *layer,`
`678`	`677`	`}`
`679`	`678`	`}`
`680`	`679`	`}`
	`680`	`+ CSLDestroy(papszAllowedDrivers);`
`681`	`681`	`return hDS;`
`682`	`682`	`} else {`
`683`	`683`	`return GDALOpenShared(*p_decrypted_path, GA_ReadOnly);`