[mapserver-commits] [MapServer/MapServer] d28fc4: Fix WCS 2.0 GetCoverage DoS from non-positive RESO...

[Zhen Yan]

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: d28fc42ad364fbe64aa669ca793af6e833b372bc
      https://github.com/MapServer/MapServer/commit/d28fc42ad364fbe64aa669ca793af6e833b372bc
  Author: Zhen Yan <89853352+sdjasj at users.noreply.github.com>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M HISTORY.md
    A msautotest/wxs/expected/wcs_20_exception_neg_resolution.xml
    A msautotest/wxs/expected/wcs_20_exception_zero_resolution.xml
    M msautotest/wxs/wcs_simple.map
    M src/mapwcs20.cpp

  Log Message:
  -----------
  Fix WCS 2.0 GetCoverage DoS from non-positive RESOLUTION (GHSA-6jr5-rc9c-p3cj) (#7575)

An unauthenticated, remotely reachable denial-of-service vulnerability
exists in MapServer's WCS 2.0 GetCoverage path. The parser accepts any
RESOLUTION value that parses as a double — including negative, zero, and
nan — without a > 0 / finiteness check. The resulting negative image
dimensions are then cast to size_t (huge value) inside
msSmallMalloc()/msSmallCalloc(). Allocation fails, and MapServer's
"safe" allocator terminates the process via exit(1). A single crafted
request kills the handling CGI/FastCGI worker.

Fix:
1. msWCSParseResolutionString20(): After parsing, reject non-finite
   values and values <= 0 with InvalidParameterValue. This mirrors the
   existing validation in msWCSParseScaleString20() which already
   rejects scale <= 0.
2. msWCSGetCoverage20(): Add a defensive guard that rejects width <= 0
   or height <= 0 before the existing MAXSIZE check. This catches any
   edge case where a non-positive dimension reaches this point.

Tests added in msautotest/wxs/wcs_simple.map:
- Negative RESOLUTION → InvalidParameterValue (was exit(1))
- Zero RESOLUTION → InvalidParameterValue (was raw alloc error)

Co-authored-by: 秦至 <yz534720 at antgroup.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications