[mapserver-commits] [MapServer/MapServer] 43373c: Fix heap out-of-bounds write in interpolation laye...

[Kaixuan Li]

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: 43373ce69028a51f988884be3d1af53e327dd5af
      https://github.com/MapServer/MapServer/commit/43373ce69028a51f988884be3d1af53e327dd5af
  Author: Kaixuan Li <kaixuan.li at ntu.edu.sg>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    A msautotest/gdal/expected/idw_oob.png
    M msautotest/gdal/idw.map
    M src/interpolation.c

  Log Message:
  -----------
  Fix heap out-of-bounds write in interpolation layers (GHSA-59gr-4vvx-5f56) (#7602)

* fix heap out-of-bounds write in interpolation layers (GHSA-59gr-4vvx-5f56)

msInterpolationDataset() sized the xyz_values buffer by the output pixel
count (WIDTH*HEIGHT) but wrote 3 floats per in-extent sample vertex, and the
vertex count is not bounded by the pixel count. An unauthenticated WMS GetMap
over an IDW/KERNELDENSITY/KRIGING layer with a grid smaller than the sample
count overflowed the heap. Grow the buffer as needed so every sample is
stored within the allocation.

Adds a regression test as an extra request in the existing
msautotest/gdal/idw.map (1000x2 grid over data/pnts.shp): it aborts under
AddressSanitizer before the fix and produces a valid image after it.

* interpolation: guard xyz_values capacity against zero

Address review feedback: keep the xyz_values capacity non-zero so the
doubling growth loop always makes progress, even in the theoretical case of a
zero-sized image where im_width*im_height would be 0.



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications