diff options
author | Jason Wray <jason@mapbox.com> | 2018-03-27 20:20:57 -0400 |
---|---|---|
committer | Jason Wray <friedbunny@users.noreply.github.com> | 2018-03-30 19:59:09 -0400 |
commit | 8c6abaf3fab0e88fde24693127615bd7f39d1ac1 (patch) | |
tree | b1316d9308186dc65f844c85844716c9c0a14a94 /platform | |
parent | 59e92904c360e5aad94a1b789276bf6147120d7c (diff) | |
download | qtlocation-mapboxgl-8c6abaf3fab0e88fde24693127615bd7f39d1ac1.tar.gz |
[ios] Fix heap buffer overflow in two-coordinate MGLPolyline
Diffstat (limited to 'platform')
-rw-r--r-- | platform/darwin/src/MGLPolyline.mm | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/platform/darwin/src/MGLPolyline.mm b/platform/darwin/src/MGLPolyline.mm index e011d09215..26e3518cd8 100644 --- a/platform/darwin/src/MGLPolyline.mm +++ b/platform/darwin/src/MGLPolyline.mm @@ -72,9 +72,12 @@ if (count > 1 || middle > traveled) { for (NSUInteger i = 0; i < count; i++) { - + + // Avoid a heap buffer overflow when there are only two coordinates. + NSUInteger nextIndex = (i + 1 == count) ? 0 : 1; + MGLRadianCoordinate2D from = MGLRadianCoordinateFromLocationCoordinate(coordinates[i]); - MGLRadianCoordinate2D to = MGLRadianCoordinateFromLocationCoordinate(coordinates[i + 1]); + MGLRadianCoordinate2D to = MGLRadianCoordinateFromLocationCoordinate(coordinates[i + nextIndex]); if (traveled >= middle) { double overshoot = middle - traveled; @@ -91,7 +94,6 @@ } traveled += (MGLDistanceBetweenRadianCoordinates(from, to) * mbgl::util::EARTH_RADIUS_M); - } } |