segfault while processing GetFeatureInfo

I have a raster layer (actually, a bunch of them) where MapServer sometimes segfaults when serving a GetFeatureInfo request, depending on the coordinate of the point being queried.  I have come up with a couple of test cases, which are exactly identical to each other except for the value of X in the GetFeatureInfo request.  In one case, X=913, and MapServer  correctly processes the GetFeatureInfo request and returns correct results.  In the other case, X=912, and MapServer segfaults.  Both of these values of X are valid, and both  correspond to pixels in the image where MapServer correctly displays the raster in question when called with a GetMap request.

My hunch is that the problem might be related to a misconfiguration of MapServer on my part, or a misconfiguration of the projections involved.  The layer data is in a LAEA projection, and due to constraints on the project that are beyond my control, I have MapServer reprojecting it to a bizarre web mercator projection (EPSG 3857, aka EPSG 3785) for output, so the GetFeatureInfo request is expressed in EPSG 3857.  But I'm stumped as to what the problem could be, and having MapServer crash with a segmentation fault seems like an indication of some kind of bug, even if I've got a configuration error.

I've tried turning on debugging in the mapfile, but nothing useful shows up in the log file.

I've tested this with several versions of MapServer, including 6.0.3 and 6.2-beta1, with the same results.  I'm running these tests on a CentOS 6.2 system, compiling MapServer with the options --with-proj --with-ogr --with-gdal --with-wfs --with-wcs --with-wms --with-wmsclient --with-wfsclient and --with-php=/usr/include/php, and using gdal 1.7.2 and
proj 4.7.0.

My mapfile is appended below, along with the two test requests I mentioned above.

The layer data file that I am using is too big to attach to this email, but I've created a tgz file containing everything needed to run my tests -- the mapfile, layer file, and test script; you can download it here:

      http://rain.nemac.org/~mbp/mapserver-gfi-problem.tgz


Here is the mapfile I am using:

    MAP
      CONFIG "MS_ERRORFILE" "mapserver.log"
      DEBUG 5
      PROJECTION
        "init=epsg:3857"
      END
      WEB
        HEADER "./dummy_template"
        FOOTER "./dummy_template"
        METADATA
          "ows_enable_request"     "*"
          "wms_srs"                "EPSG:3857"
        END
      END
      LAYER
        NAME layer1
        PROJECTION
          "+proj=laea"
          "+lat_0=45"
          "+lon_0=-100"
          "+x_0=0"
          "+y_0=0"
          "+a=6370997"
          "+b=6370997"
          "+units=m"
          "+no_defs"
        END
        TYPE     RASTER
        DUMP     TRUE
        STATUS   OFF
        DATA     layer1.tif
        HEADER   ./dummy_template
        TEMPLATE ./dummy_template
        METADATA
          "wms_title"             "layer1"
          "wms_abstract"          "layer1"
          "gml_include_items"     "value_0"
        END
      END
    END

And here are the two query strings for the two test cases:

this one runs correctly:
    map=./mapfile.map&TRANSPARENT=true&SERVICE=WMS&VERSION=1.3.0&REQUEST=GetFeatureInfo&STYLES=&FORMAT=image/png&INFO_FORMAT=application/vnd.ogc.gml&BBOX=-11859604.53136514,4696887.582602486,-11830673.11615924,4710053.860724591&CRS=EPSG:3857&LAYERS=layer1&QUERY_LAYERS=layer1&WIDTH=1514&HEIGHT=689&X=913&Y=334

this one causes a seg fault:
    map=./mapfile.map&TRANSPARENT=true&SERVICE=WMS&VERSION=1.3.0&REQUEST=GetFeatureInfo&STYLES=&FORMAT=image/png&INFO_FORMAT=application/vnd.ogc.gml&BBOX=-11859604.53136514,4696887.582602486,-11830673.11615924,4710053.860724591&CRS=EPSG:3857&LAYERS=layer1&QUERY_LAYERS=layer1&WIDTH=1514&HEIGHT=689&X=912&Y=334