WMS: fix nullptr dereference on invalid document (fixes https://bugs.…

…chromium.org/p/oss-fuzz/issues/detail?id=65772)
tmSreedarsh · Jan 15, 2024 · 4da3841 · 4da3841
1 parent 85b624a
commit 4da3841
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/autotest/gdrivers/wms.py b/autotest/gdrivers/wms.py
@@ -1155,3 +1155,6 @@ def test_wms_cache_path():
             ds.GetMetadataItem("CACHE_PATH").replace("\\", "/")
             == "./gdalwmscache_b37af3c29458379e6fdf4ed73300f54e/b37af3c29458379e6fdf4ed73300f54e"
         )
+
+    with pytest.raises(Exception):
+        gdal.Open("<GDAL_WMS><Service/><Cache/></GDAL_WMS>")
diff --git a/frmts/wms/gdalwmscache.cpp b/frmts/wms/gdalwmscache.cpp
@@ -296,7 +296,9 @@ CPLErr GDALWMSCache::Initialize(const char *pszUrl, CPLXMLNode *pConfig)
             else
             {
                 m_osCachePath = CPLFormFilename(
-                    pszDir, CPLSPrintf("gdalwmscache_%s", CPLMD5String(pszUrl)),
+                    pszDir,
+                    CPLSPrintf("gdalwmscache_%s",
+                               CPLMD5String(pszUrl ? pszUrl : "")),
                     nullptr);
             }
         }
@@ -305,8 +307,8 @@ CPLErr GDALWMSCache::Initialize(const char *pszUrl, CPLXMLNode *pConfig)
     // Separate folder for each unique dataset url
     if (CPLTestBool(CPLGetXMLValue(pConfig, "Unique", "True")))
     {
-        m_osCachePath =
-            CPLFormFilename(m_osCachePath, CPLMD5String(pszUrl), nullptr);
+        m_osCachePath = CPLFormFilename(
+            m_osCachePath, CPLMD5String(pszUrl ? pszUrl : ""), nullptr);
     }
     CPLDebug("WMS", "Using %s for cache", m_osCachePath.c_str());