@@ -815,24 +815,29 @@ spherepoly_in(PG_FUNCTION_ARGS)
815815char * c = PG_GETARG_CSTRING (0 );
816816int32 i ,
817817nelem ;
818- SPoint * arr ;
819818
820819void sphere_yyparse (void );
821820
822821init_buffer (c );
823822sphere_yyparse ();
824823
825824nelem = get_path_count ();
825+ if (nelem > MAX_POINTS )
826+ {
827+ reset_buffer ();
828+ elog (ERROR ,"spherepoly_in: too much points" );
829+ PG_RETURN_NULL ();
830+
831+ }
826832if (nelem > 2 )
827833{
828- arr = ( SPoint * ) palloc ( sizeof ( SPoint ) * nelem ) ;
834+ SPoint arr [ MAX_POINTS ] ;
829835
830836for (i = 0 ;i < nelem ;i ++ )
831837{
832838get_path_elem (i ,& arr [i ].lng ,& arr [i ].lat );
833839}
834840poly = spherepoly_from_array (& arr [0 ],nelem );
835- pfree (arr );
836841}
837842else
838843{
@@ -894,12 +899,11 @@ spherepoly_area(PG_FUNCTION_ARGS)
894899{
895900SPOLY * poly = PG_GETARG_SPOLY (0 );
896901int32 i ;
897- SPoint * s ;
902+ SPoint s [ MAX_POINTS + 2 ] ;
898903SPoint stmp [2 ];
899904SEuler se ;
900905float8 sum = 0.0 ;
901906
902- s = (SPoint * )palloc (sizeof (SPoint )* (poly -> npts + 2 ));
903907memcpy ((void * )& s [1 ],
904908 (void * )& poly -> p [0 ],
905909poly -> npts * sizeof (SPoint ));
@@ -939,7 +943,6 @@ spherepoly_area(PG_FUNCTION_ARGS)
939943sum = 0.0 ;
940944}
941945
942- pfree (s );
943946PG_RETURN_FLOAT8 (sum );
944947}
945948