[mapserver-commits] [MapServer/MapServer] 7f354f: Fix SMOOTHSIA point-shape DoS in CGI query path (G...

[Zhen Yan]

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: 7f354ff84a53dd6f535b3aa35459db9319a265fd
      https://github.com/MapServer/MapServer/commit/7f354ff84a53dd6f535b3aa35459db9319a265fd
  Author: Zhen Yan <89853352+sdjasj at users.noreply.github.com>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M HISTORY.md
    A msautotest/query/data/point.geojson
    A msautotest/query/expected/smoothsia_point_test001.txt
    A msautotest/query/smoothsia_point.map
    M src/mapsmoothing.c

  Log Message:
  -----------
  Fix SMOOTHSIA point-shape DoS in CGI query path (GHSA-33h3-f4q2-pq5q) (#7576)

An unauthenticated denial of service was possible in the CGI query path
(mode=ITEMNQUERY / ITEMQUERY). The qstring expression exposes
SMOOTHSIA([shape], ss, si); msSmoothShapeSIA() derived the per-line
smoothing window size without guarding the single-point case. For a
point feature, numpoints == 1 makes ws collapse to 0 and then to -1,
which is widened to a huge size_t in initLineWindow()'s first
allocation. msSmallMalloc() cannot satisfy it, prints an out-of-memory
message and calls exit(1), killing the worker on every request.

Fixes:
- msSmoothShapeSIA(): skip lines with fewer than 3 points (copied
  verbatim, since they cannot be smoothed) and clamp the derived window
  size to a positive odd number.
- initLineWindow(): defensively clamp a non-positive size to 1 so a
  future caller cannot re-introduce the huge-allocation crash.

Adds an msautotest regression test (query/smoothsia_point.map) that runs
SMOOTHSIA on a point layer via an itemnquery qstring and confirms the
worker no longer terminates.

Co-authored-by: 秦至 <yz534720 at antgroup.com>
Co-authored-by: Jeff McKenna <jmckenna at gatewaygeomatics.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications