mappool.c: only raise connectionMax after a successful realloc (fixes #7614) - #7616
Open
MarkLee131 wants to merge 1 commit into
Open
mappool.c: only raise connectionMax after a successful realloc (fixes #7614)#7616MarkLee131 wants to merge 1 commit into
MarkLee131 wants to merge 1 commit into
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
…apServer#7614) msConnPoolRegister() incremented connectionMax before the realloc() that was meant to deliver the new capacity, and did not restore it when the allocation failed. After one failed grow the recorded capacity stayed 10 entries ahead of the real one, and because the guard was an equality test the growth path never ran again, so the following registrations each wrote a whole connectionObj past the end of the array. Move the increment after the successful realloc and make the guard >= so that a count which has passed the capacity still grows the array. This completes f4286d6, which stopped a failed realloc from leaking and from nulling connections, but left the connectionMax desync in place. That turned what used to be a near-NULL crash into a silent heap overflow.
jmckenna
approved these changes
Aug 27, 2026
jmckenna
marked this pull request as ready for review
August 27, 2026 13:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This moves the increment after the successful realloc and changes the guard to >=.
It completes f4286d6: that commit stopped the failed realloc from leaking and from nulling connections, but left the connectionMax desync in place, which turned the old near-NULL crash into a silent heap overflow.
What are related issues/pull requests?
Fixes #7614
Tasklist
I could not find a way to write this one as an msautotest case. Triggering it needs the pool array's realloc() to fail, and the suite has no way to inject an allocation failure; msConnPoolRegister() is also not exposed to MapScript, and its callers are the database drivers, so reaching it from the test suite would need a live backend as well. The C reproducer in the issue covers it instead. Glad to add a test if you see an angle I missed.