[mapserver-commits] [MapServer/MapServer] c3e81a: [Backport branch-8-6] Fix heap out-of-bounds write...

[github-actions[bot]]

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: c3e81ac9c0c6592f8a8b050b66f1d456c751c7d4
      https://github.com/MapServer/MapServer/commit/c3e81ac9c0c6592f8a8b050b66f1d456c751c7d4
  Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  Date:   2026-08-28 (Fri, 28 Aug 2026)

  Changed paths:
    A msautotest/gdal/expected/idw_oob.png
    M msautotest/gdal/idw.map
    M src/interpolation.c

  Log Message:
  -----------
  [Backport branch-8-6] Fix heap out-of-bounds write in interpolation layers (GHSA-59gr-4vvx-5f56) (#7620)

* fix heap out-of-bounds write in interpolation layers (GHSA-59gr-4vvx-5f56)

msInterpolationDataset() sized the xyz_values buffer by the output pixel
count (WIDTH*HEIGHT) but wrote 3 floats per in-extent sample vertex, and the
vertex count is not bounded by the pixel count. An unauthenticated WMS GetMap
over an IDW/KERNELDENSITY/KRIGING layer with a grid smaller than the sample
count overflowed the heap. Grow the buffer as needed so every sample is
stored within the allocation.

Adds a regression test as an extra request in the existing
msautotest/gdal/idw.map (1000x2 grid over data/pnts.shp): it aborts under
AddressSanitizer before the fix and produces a valid image after it.

* interpolation: guard xyz_values capacity against zero

Address review feedback: keep the xyz_values capacity non-zero so the
doubling growth loop always makes progress, even in the theoretical case of a
zero-sized image where im_width*im_height would be 0.

---------

Co-authored-by: MarkLee131 <kaixuan.li at ntu.edu.sg>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications