From 3a588b0ad0e3278c3d142302e812be52a89c503c Mon Sep 17 00:00:00 2001
From: Eric Fischer <enf@pobox.com>
Date: Fri, 17 Aug 2018 14:44:59 -0700
Subject: [PATCH] Fix another tile-join crash

---
 tile-join.cpp | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/tile-join.cpp b/tile-join.cpp
index c0c6368..f2ae37e 100644
--- a/tile-join.cpp
+++ b/tile-join.cpp
@@ -153,6 +153,10 @@ void handle(std::string message, int z, unsigned x, unsigned y, std::map<std::st
 				std::map<std::string, mvt_value> attributes;
 
 				for (size_t t = 0; t + 1 < feat.tags.size(); t += 2) {
+					if (feat.tags[t] >= layer.keys.size() || feat.tags[t + 1] >= layer.values.size()) {
+						fprintf(stderr, "Out of bounds attribute reference\n");
+						exit(EXIT_FAILURE);
+					}
 					std::string key = layer.keys[feat.tags[t]];
 					mvt_value &val = layer.values[feat.tags[t + 1]];
 
@@ -160,7 +164,11 @@ void handle(std::string message, int z, unsigned x, unsigned y, std::map<std::st
 				}
 
 				for (size_t t = 0; t + 1 < feat.properties.size(); t++) {
-					std::string key = layer.keys[feat.properties[t]];
+					if (feat.properties[t] >= layer.attribute_pool.keys.size()) {
+						fprintf(stderr, "Out of bounds attribute reference\n");
+						exit(EXIT_FAILURE);
+					}
+					std::string key = layer.attribute_pool.keys[feat.properties[t]];
 					t++;
 					mvt_value val = layer.decode_property(feat.properties, t);
 
@@ -210,6 +218,10 @@ void handle(std::string message, int z, unsigned x, unsigned y, std::map<std::st
 			std::vector<std::pair<std::string, mvt_value>> todo;
 
 			for (size_t t = 0; t + 1 < feat.tags.size(); t += 2) {
+				if (feat.tags[t] >= layer.keys.size() || feat.tags[t + 1] >= layer.values.size()) {
+					fprintf(stderr, "Out of bounds attribute reference\n");
+					exit(EXIT_FAILURE);
+				}
 				std::string key = layer.keys[feat.tags[t]];
 				mvt_value &val = layer.values[feat.tags[t + 1]];