From: Paul Ramsey <pramsey@cleverelephant.ca>
Date: Tue, 23 Feb 2016 16:57:57 +0000 (+0000)
Subject: #3461 ST_GeomFromKML crashes Postgres when there are innerBoundaryIs and no outerBoun... 
X-Git-Tag: 2.3.0beta1~250
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1c0290d8ea93493e49733830b79ff84cc5b640da;p=postgis

#3461 ST_GeomFromKML crashes Postgres when there are innerBoundaryIs and no outerBoundaryIs


git-svn-id: http://svn.osgeo.org/postgis/trunk@14669 b70326c6-7e19-0410-871a-916f4a2858ee
---

diff --git a/postgis/lwgeom_in_kml.c b/postgis/lwgeom_in_kml.c
index ebe21c72a..46126893e 100644
--- a/postgis/lwgeom_in_kml.c
+++ b/postgis/lwgeom_in_kml.c
@@ -401,6 +401,7 @@ static LWGEOM* parse_kml_polygon(xmlNodePtr xnode, bool *hasz)
 	int ring;
 	xmlNodePtr xa, xb;
 	POINTARRAY **ppa = NULL;
+	int outer_rings = 0;
 
 	for (xa = xnode->children ; xa != NULL ; xa = xa->next)
 	{
@@ -431,9 +432,13 @@ static LWGEOM* parse_kml_polygon(xmlNodePtr xnode, bool *hasz)
 				ptarray_append_point(ppa[0], &pt, LW_TRUE);
 				lwpgnotice("forced closure on an un-closed KML polygon");
 			}
+			outer_rings++;
 		}
 	}
-
+	
+	if (outer_rings != 1)
+		lwpgerror("invalid KML representation");
+		 
 	for (ring=1, xa = xnode->children ; xa != NULL ; xa = xa->next)
 	{
 
@@ -449,8 +454,7 @@ static LWGEOM* parse_kml_polygon(xmlNodePtr xnode, bool *hasz)
 			if (!is_kml_namespace(xb, false)) continue;
 			if (strcmp((char *) xb->name, "LinearRing")) continue;
 
-			ppa = (POINTARRAY**) lwrealloc((POINTARRAY *) ppa,
-			                               sizeof(POINTARRAY*) * (ring + 1));
+			ppa = (POINTARRAY**) lwrealloc(ppa, sizeof(POINTARRAY*) * (ring + 1));
 			ppa[ring] = parse_kml_coordinates(xb->children, hasz);
 
 			if (ppa[ring]->npoints < 4)