[mapserver-commits] [MapServer/MapServer] 0462ee: flatgeobuf: fix out of bounds read after index sea...

[Paul Pazderski]

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: 0462eeab18d682e87ddbad4e0155c43e763df563
      https://github.com/MapServer/MapServer/commit/0462eeab18d682e87ddbad4e0155c43e763df563
  Author: Paul Pazderski <github at ppazderski.de>
  Date:   2024-03-10 (Sun, 10 Mar 2024)

  Changed paths:
    A msautotest/misc/expected/flatgeobuf-ocean.png
    M msautotest/misc/flatgeobuf.map
    M src/mapflatgeobuf.c

  Log Message:
  -----------
  flatgeobuf: fix out of bounds read after index search without results (#7040)

This bug has multiple layers. If an index search is performed in
msFlatGeobufLayerWhichShapes and the search has no result then
flatgeobuf_index_search will set search_result_len to zero but also
allocate a buffer for zero results.

Such a zero size allocation can return a null pointer or a pointer to
a random location. Both cases were problematic.

msFlatGeobufLayerNextShape interprets a null pointer as search_result as
index was skipped and will try to read all features but the file handle
is at the wrong offset if the index was actually used.

If search_result was given a non-null pointer msFlatGeobufLayerNextShape
will check if there are more results found with the following condition:
  if (ctx->search_index >= ctx->search_result_len - 1)
    return MS_DONE;
With an empty search the result length is zero and because it is unsigned
it will underflow and check return false. As consequence it will read the
first search result where none is.

The outcome is that item.offset is a random value and either the following
seek fails (which results in a maperror) or if it succeeds the following
read most likely fails with an EOF (which then produces the correct output
by accident and no error) or if the read succeeds the following buffer
allocation most likely fails as "too huge" or if that also succeeds decoding
of the next feature will most likely fail.



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications