[mapserver-commits] [MapServer/MapServer] 5f314c: Fix SMOOTHSIA point-shape DoS in CGI query path (G...

[Jeff McKenna]

  Branch: refs/heads/backport-7575-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: 5f314cf8e3ad0e9f54205e6044324ae94a6ce886
      https://github.com/MapServer/MapServer/commit/5f314cf8e3ad0e9f54205e6044324ae94a6ce886
  Author: Zhen Yan <89853352+sdjasj at users.noreply.github.com>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M HISTORY.md
    A msautotest/query/data/point.geojson
    A msautotest/query/expected/smoothsia_point_test001.txt
    A msautotest/query/smoothsia_point.map
    M src/mapsmoothing.c

  Log Message:
  -----------
  Fix SMOOTHSIA point-shape DoS in CGI query path (GHSA-33h3-f4q2-pq5q) (#7576)

An unauthenticated denial of service was possible in the CGI query path
(mode=ITEMNQUERY / ITEMQUERY). The qstring expression exposes
SMOOTHSIA([shape], ss, si); msSmoothShapeSIA() derived the per-line
smoothing window size without guarding the single-point case. For a
point feature, numpoints == 1 makes ws collapse to 0 and then to -1,
which is widened to a huge size_t in initLineWindow()'s first
allocation. msSmallMalloc() cannot satisfy it, prints an out-of-memory
message and calls exit(1), killing the worker on every request.

Fixes:
- msSmoothShapeSIA(): skip lines with fewer than 3 points (copied
  verbatim, since they cannot be smoothed) and clamp the derived window
  size to a positive odd number.
- initLineWindow(): defensively clamp a non-positive size to 1 so a
  future caller cannot re-introduce the huge-allocation crash.

Adds an msautotest regression test (query/smoothsia_point.map) that runs
SMOOTHSIA on a point layer via an itemnquery qstring and confirms the
worker no longer terminates.

Co-authored-by: 秦至 <yz534720 at antgroup.com>
Co-authored-by: Jeff McKenna <jmckenna at gatewaygeomatics.com>


  Commit: 3d6ef77735c61fe43dc23a9266eb9db0dfe92ce1
      https://github.com/MapServer/MapServer/commit/3d6ef77735c61fe43dc23a9266eb9db0dfe92ce1
  Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    A msautotest/misc/clip_polygon_corners.map
    A msautotest/misc/expected/clip_polygon_corners.png
    M src/mapprimitive.cpp

  Log Message:
  -----------
  [Backport branch-8-6] size msClipPolygonRect buffer for 3 emitted points per edge (#7588)

* size msClipPolygonRect buffer for 3 emitted points per edge

* add msautotest case for polygon clipping at the rect corners

Two inline rings whose edges cut across the corners of the clip rectangle,
so a single edge emits three points and the clipped rings come out at 14 and
16 points from 6 and 7. Against the previous 2*numpoints allocation this
aborts under ASAN in msDrawShape().

---------

Co-authored-by: Naveed <naveed at bugqore.com>


  Commit: 7685c4f6410fadba053bca7d5ba6da2156e53d67
      https://github.com/MapServer/MapServer/commit/7685c4f6410fadba053bca7d5ba6da2156e53d67
  Author: Jeff McKenna <jmckenna at gatewaygeomatics.com>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M HISTORY.md
    A msautotest/misc/clip_polygon_corners.map
    A msautotest/misc/expected/clip_polygon_corners.png
    A msautotest/query/data/point.geojson
    A msautotest/query/expected/smoothsia_point_test001.txt
    A msautotest/query/smoothsia_point.map
    M src/mapprimitive.cpp
    M src/mapsmoothing.c

  Log Message:
  -----------
  Merge branch 'branch-8-6' into backport-7575-to-branch-8-6


Compare: https://github.com/MapServer/MapServer/compare/6cccc5ac00bd...7685c4f6410f

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications