#3461 ST_GeomFromKML crashes Postgres when there are innerBoundaryIs and no outerBoun...

git-svn-id: http://svn.osgeo.org/postgis/trunk@14669 b70326c6-7e19-0410-871a-916f4a2858ee

diff --git a/postgis/lwgeom_in_kml.c b/postgis/lwgeom_in_kml.c
index ebe21c72ab8e0f345dd6fbe4dabbc63b72516bd2..46126893ec6a4e0873abd506cee7f74b1d8461b7 100644 (file)
--- a/postgis/lwgeom_in_kml.c
+++ b/postgis/lwgeom_in_kml.c
@@ -401,6 +401,7 @@ static LWGEOM* parse_kml_polygon(xmlNodePtr xnode, bool *hasz)
        int ring;
        xmlNodePtr xa, xb;
        POINTARRAY **ppa = NULL;
+       int outer_rings = 0;
 
        for (xa = xnode->children ; xa != NULL ; xa = xa->next)
        {
@@ -431,9 +432,13 @@ static LWGEOM* parse_kml_polygon(xmlNodePtr xnode, bool *hasz)
                                ptarray_append_point(ppa[0], &pt, LW_TRUE);
                                lwpgnotice("forced closure on an un-closed KML polygon");
                        }
+                       outer_rings++;
                }
        }
-
+       
+       if (outer_rings != 1)
+               lwpgerror("invalid KML representation");
+                
        for (ring=1, xa = xnode->children ; xa != NULL ; xa = xa->next)
        {
 
@@ -449,8 +454,7 @@ static LWGEOM* parse_kml_polygon(xmlNodePtr xnode, bool *hasz)
                        if (!is_kml_namespace(xb, false)) continue;
                        if (strcmp((char *) xb->name, "LinearRing")) continue;
 
-                       ppa = (POINTARRAY**) lwrealloc((POINTARRAY *) ppa,
-                                                      sizeof(POINTARRAY*) * (ring + 1));
+                       ppa = (POINTARRAY**) lwrealloc(ppa, sizeof(POINTARRAY*) * (ring + 1));
                        ppa[ring] = parse_kml_coordinates(xb->children, hasz);
 
                        if (ppa[ring]->npoints < 4)