[postgis-tickets] [SCM] PostGIS branch stable-2.3 updated. 8475f493275ee1f262f00ef007a24eef16737dfa

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, stable-2.3 has been updated
       via  8475f493275ee1f262f00ef007a24eef16737dfa (commit)
      from  deb1d00953b73e6a039ddcd83a5c078c2702ec7f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8475f493275ee1f262f00ef007a24eef16737dfa
Author: Raúl Marín <git at rmr.ninja>
Date:   Fri Jan 17 17:22:42 2020 +0100

    Prevent stack overflow when parsing WKB
    
    Closes #4621

diff --git a/NEWS b/NEWS
index a1a61a1..0b353f3 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,7 @@ XXXX/XX/XX
   - #4547, Fix AddRasterConstraints handling of empty tables (Sandro Santilli)
   - #4549, Fix schema qualification of internal types (Raúl Marín)
   - #4546, Fix PLPGSQL functions missing the schema qualification (Raúl Marín)
+  - #4621, Prevent stack overflow when parsing WKB (Raúl Marín)
 
 PostGIS 2.3.10
 2019/08/11
diff --git a/liblwgeom/cunit/cu_in_wkb.c b/liblwgeom/cunit/cu_in_wkb.c
index f1b8546..6cf7a90 100644
--- a/liblwgeom/cunit/cu_in_wkb.c
+++ b/liblwgeom/cunit/cu_in_wkb.c
@@ -252,6 +252,14 @@ test_wkb_leak(void)
 	    001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001, 001};
 	g = lwgeom_from_wkb(wkb2, 319, LW_PARSER_CHECK_NONE);
 	lwgeom_free(g);
+
+	/* OSS-FUZZ: https://trac.osgeo.org/postgis/ticket/4621 */
+	uint32_t big_size = 20000000;
+	uint8_t *wkb5 = lwalloc(big_size);
+	memset(wkb5, 0x01, big_size);
+	g = lwgeom_from_wkb(wkb5, big_size, LW_PARSER_CHECK_NONE);
+	lwgeom_free(g);
+	lwfree(wkb5);
 }
 
 /*
diff --git a/liblwgeom/lwin_wkb.c b/liblwgeom/lwin_wkb.c
index 4ff5b83..3f5a6d6 100644
--- a/liblwgeom/lwin_wkb.c
+++ b/liblwgeom/lwin_wkb.c
@@ -29,6 +29,9 @@
 #include "lwgeom_log.h"
 #include <math.h>
 
+/** Max depth in a geometry. Matches the default YYINITDEPTH for WKT */
+#define LW_PARSER_MAX_DEPTH 200
+
 /**
 * Used for passing the parse state between the parsing functions.
 */
@@ -43,6 +46,7 @@ typedef struct
 	int has_z; /* Z? */
 	int has_m; /* M? */
 	int has_srid; /* SRID? */
+	uint8_t depth;      /* Current recursion level (to prevent stack overflows). Maxes at LW_PARSER_MAX_DEPTH */
 	const uint8_t *pos; /* Current parse position */
 } wkb_parse_state;
 
@@ -650,6 +654,13 @@ static LWCOLLECTION* lwcollection_from_wkb_state(wkb_parse_state *s)
 	if ( s->lwtype == POLYHEDRALSURFACETYPE )
 		s->check |= LW_PARSER_CHECK_ZCLOSURE;
 
+	s->depth++;
+	if (s->depth >= LW_PARSER_MAX_DEPTH)
+	{
+		lwcollection_free(col);
+		lwerror("Geometry has too many chained collections");
+		return NULL;
+	}
 	for ( i = 0; i < ngeoms; i++ )
 	{
 		geom = lwgeom_from_wkb_state(s);
@@ -661,7 +672,8 @@ static LWCOLLECTION* lwcollection_from_wkb_state(wkb_parse_state *s)
 			return NULL;
 		}
 	}
-	
+	s->depth--;
+
 	return col;
 }
 
@@ -784,7 +796,8 @@ LWGEOM* lwgeom_from_wkb(const uint8_t *wkb, const size_t wkb_size, const char ch
 	s.has_m = LW_FALSE;
 	s.has_srid = LW_FALSE;
 	s.pos = wkb;
-	
+	s.depth = 1;
+
 	/* Hand the check catch-all values */
 	if ( check & LW_PARSER_CHECK_NONE )
 		s.check = 0;

-----------------------------------------------------------------------

Summary of changes:
 NEWS                        |  1 +
 liblwgeom/cunit/cu_in_wkb.c |  8 ++++++++
 liblwgeom/lwin_wkb.c        | 17 +++++++++++++++--
 3 files changed, 24 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
PostGIS