[GML parser/WFS provider] Fix crash when typename and geometry field name are identical (fixes #15942)

rouault · rouault · commit 8ae45fabeeec · 2017-11-11T12:17:29.000+01:00
diff --git a/src/core/qgsgml.cpp b/src/core/qgsgml.cpp
@@ -555,7 +555,9 @@ void QgsGmlStreamingParser::startElement( const XML_Char* el, const XML_Char** a
       }
     }
   }
-  else if ( localNameLen == static_cast<int>( mGeometryAttributeUTF8Len ) &&
+  else if ( ( theParseMode == feature || theParseMode == featureTuple ) &&
+            mCurrentFeature &&
+            localNameLen == static_cast<int>( mGeometryAttributeUTF8Len ) &&
             memcmp( pszLocalName, mGeometryAttributePtr, localNameLen ) == 0 )
   {
     mParseModeStack.push( QgsGmlStreamingParser::geometry );
@@ -903,6 +905,7 @@ void QgsGmlStreamingParser::endElement( const XML_Char* el )
         {
           g->transform( QTransform( 0, 1, 1, 0, 0, 0 ) );
         }
+        Q_ASSERT( mCurrentFeature );
         mCurrentFeature->setGeometry( g );
         OGR_G_DestroyGeometry( hGeom );
       }
diff --git a/tests/src/core/testqgsgml.cpp b/tests/src/core/testqgsgml.cpp
@@ -76,6 +76,7 @@ class TestQgsGML : public QObject
     void testThroughOGRGeometry();
     void testThroughOGRGeometry_urn_EPSG_4326();
     void testAccents();
+    void testSameTypeameAsGeomName();
 };
 
 const QString data1( "<myns:FeatureCollection "
@@ -1149,6 +1150,51 @@ void TestQgsGML::testAccents()
   QCOMPARE( multi[0][0].size(), 5 );
   delete features[0].first;
 }
+void TestQgsGML::testSameTypeameAsGeomName()
+{
+  QgsFields fields;
+  QgsGmlStreamingParser gmlParser( "foo", "foo", fields );
+  QCOMPARE( gmlParser.processData( QByteArray( "<myns:FeatureCollection "
+                                   "xmlns:myns='http://myns' "
+                                   "xmlns:gml='http://www.opengis.net/gml'>"
+                                   "<gml:featureMember>"
+                                   "<myns:foo fid='foo.1'>"
+                                   "<myns:foo>"
+                                   "<gml:MultiSurface srsName='EPSG:27700'>"
+                                   "<gml:surfaceMember>"
+                                   "<gml:Polygon srsName='EPSG:27700'>"
+                                   "<gml:exterior>"
+                                   "<gml:LinearRing>"
+                                   "<gml:posList>0 0 0 10 10 10 10 0 0 0</gml:posList>"
+                                   "</gml:LinearRing>"
+                                   "</gml:exterior>"
+                                   "</gml:Polygon>"
+                                   "</gml:surfaceMember>"
+                                   "<gml:surfaceMember>"
+                                   "<gml:Polygon srsName='EPSG:27700'>"
+                                   "<gml:exterior>"
+                                   "<gml:LinearRing>"
+                                   "<gml:posList>0 0 0 10 10 10 10 0 0 0</gml:posList>"
+                                   "</gml:LinearRing>"
+                                   "</gml:exterior>"
+                                   "</gml:Polygon>"
+                                   "</gml:surfaceMember>"
+                                   "</gml:MultiSurface>"
+                                   "</myns:foo>"
+                                   "</myns:foo>"
+                                   "</gml:featureMember>"
+                                   "</myns:FeatureCollection>" ), true ), true );
+  QCOMPARE( gmlParser.wkbType(), QGis::WKBMultiPolygon );
+  QVector<QgsGmlStreamingParser::QgsGmlFeaturePtrGmlIdPair> features = gmlParser.getAndStealReadyFeatures();
+  QCOMPARE( features.size(), 1 );
+  QVERIFY( features[0].first->constGeometry() != nullptr );
+  QCOMPARE( features[0].first->constGeometry()->wkbType(), QGis::WKBMultiPolygon );
+  QgsMultiPolygon multi = features[0].first->constGeometry()->asMultiPolygon();
+  QCOMPARE( multi.size(), 2 );
+  QCOMPARE( multi[0].size(), 1 );
+  QCOMPARE( multi[0][0].size(), 5 );
+  delete features[0].first;
+}
 
 QTEST_MAIN( TestQgsGML )
 #include "testqgsgml.moc"

Original file line number	Diff line number	Diff line change
`@@ -555,7 +555,9 @@ void QgsGmlStreamingParser::startElement( const XML_Char* el, const XML_Char** a`
`555`	`555`	`}`
`556`	`556`	`}`
`557`	`557`	`}`
`558`		`- else if ( localNameLen == static_cast<int>( mGeometryAttributeUTF8Len ) &&`
	`558`	`+ else if ( ( theParseMode == feature \|\| theParseMode == featureTuple ) &&`
	`559`	`+ mCurrentFeature &&`
	`560`	`+ localNameLen == static_cast<int>( mGeometryAttributeUTF8Len ) &&`
`559`	`561`	`memcmp( pszLocalName, mGeometryAttributePtr, localNameLen ) == 0 )`
`560`	`562`	`{`
`561`	`563`	`mParseModeStack.push( QgsGmlStreamingParser::geometry );`
`@@ -903,6 +905,7 @@ void QgsGmlStreamingParser::endElement( const XML_Char* el )`
`903`	`905`	`{`
`904`	`906`	`g->transform( QTransform( 0, 1, 1, 0, 0, 0 ) );`
`905`	`907`	`}`
	`908`	`+ Q_ASSERT( mCurrentFeature );`
`906`	`909`	`mCurrentFeature->setGeometry( g );`
`907`	`910`	`OGR_G_DestroyGeometry( hGeom );`
`908`	`911`	`}`