[postgis-tickets] [SCM] PostGIS branch stable-2.5 updated. affe90f899be574db12502164b10a60fc01b40da

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, stable-2.5 has been updated
       via  affe90f899be574db12502164b10a60fc01b40da (commit)
      from  a8e0c27371aa78c3c3d902cd5876aef0f660ad6b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit affe90f899be574db12502164b10a60fc01b40da
Author: Raúl Marín <git at rmr.ninja>
Date:   Fri Jan 17 17:22:42 2020 +0100

    Prevent stack overflow when parsing WKB
    
    References #4621

diff --git a/NEWS b/NEWS
index 0ecaa36..f5b6302 100644
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,7 @@ PostGIS 2.5.4
   - #4588, Fix update when st_union(geometry) doesn't exist (Raúl Marín)
   - #4599, ST_AddPoint: Accept -1 as a valid position (Raúl Marín)
   - #4605, Fix postgis_upgrade.pl with PostgreSQL 12 (Matti Linnanvuori)
+  - #4621, Prevent stack overflow when parsing WKB (Raúl Marín)
 
 
 PostGIS 2.5.3
diff --git a/liblwgeom/cunit/cu_in_wkb.c b/liblwgeom/cunit/cu_in_wkb.c
index 5a47057..a627295 100644
--- a/liblwgeom/cunit/cu_in_wkb.c
+++ b/liblwgeom/cunit/cu_in_wkb.c
@@ -256,6 +256,14 @@ test_wkb_leak(void)
 	    001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001};
 	g = lwgeom_from_wkb(wkb2, 319, LW_PARSER_CHECK_NONE);
 	lwgeom_free(g);
+
+	/* OSS-FUZZ: https://trac.osgeo.org/postgis/ticket/4621 */
+	uint32_t big_size = 20000000;
+	uint8_t *wkb5 = lwalloc(big_size);
+	memset(wkb5, 0x01, big_size);
+	g = lwgeom_from_wkb(wkb5, big_size, LW_PARSER_CHECK_NONE);
+	lwgeom_free(g);
+	lwfree(wkb5);
 }
 
 /*
diff --git a/liblwgeom/lwin_wkb.c b/liblwgeom/lwin_wkb.c
index 6488c9e..7147000 100644
--- a/liblwgeom/lwin_wkb.c
+++ b/liblwgeom/lwin_wkb.c
@@ -30,6 +30,9 @@
 #include <math.h>
 #include <limits.h>
 
+/** Max depth in a geometry. Matches the default YYINITDEPTH for WKT */
+#define LW_PARSER_MAX_DEPTH 200
+
 /**
 * Used for passing the parse state between the parsing functions.
 */
@@ -44,6 +47,7 @@ typedef struct
 	int has_z; /* Z? */
 	int has_m; /* M? */
 	int has_srid; /* SRID? */
+	uint8_t depth;      /* Current recursion level (to prevent stack overflows). Maxes at LW_PARSER_MAX_DEPTH */
 	const uint8_t *pos; /* Current parse position */
 } wkb_parse_state;
 
@@ -655,6 +659,13 @@ static LWCOLLECTION* lwcollection_from_wkb_state(wkb_parse_state *s)
 	if ( s->lwtype == POLYHEDRALSURFACETYPE )
 		s->check |= LW_PARSER_CHECK_ZCLOSURE;
 
+	s->depth++;
+	if (s->depth >= LW_PARSER_MAX_DEPTH)
+	{
+		lwcollection_free(col);
+		lwerror("Geometry has too many chained collections");
+		return NULL;
+	}
 	for ( i = 0; i < ngeoms; i++ )
 	{
 		geom = lwgeom_from_wkb_state(s);
@@ -666,6 +677,7 @@ static LWCOLLECTION* lwcollection_from_wkb_state(wkb_parse_state *s)
 			return NULL;
 		}
 	}
+	s->depth--;
 
 	return col;
 }
@@ -789,6 +801,7 @@ LWGEOM* lwgeom_from_wkb(const uint8_t *wkb, const size_t wkb_size, const char ch
 	s.has_m = LW_FALSE;
 	s.has_srid = LW_FALSE;
 	s.pos = wkb;
+	s.depth = 1;
 
 	return lwgeom_from_wkb_state(&s);
 }

-----------------------------------------------------------------------

Summary of changes:
 NEWS                        |  1 +
 liblwgeom/cunit/cu_in_wkb.c |  8 ++++++++
 liblwgeom/lwin_wkb.c        | 13 +++++++++++++
 3 files changed, 22 insertions(+)


hooks/post-receive
-- 
PostGIS