From noreply at github.com Fri Jul 3 06:22:43 2026 From: noreply at github.com (Arthur Chan) Date: Fri, 03 Jul 2026 06:22:43 -0700 Subject: [mapserver-commits] [MapServer/MapServer] d32331: Bug: Fix memory leak on param handling (#7539) Message-ID: Branch: refs/heads/main Home: https://github.com/MapServer/MapServer Commit: d32331fa65473e6705eacaec776b9bb5ac10082b https://github.com/MapServer/MapServer/commit/d32331fa65473e6705eacaec776b9bb5ac10082b Author: Arthur Chan Date: 2026-07-03 (Fri, 03 Jul 2026) Changed paths: M msautotest/wxs/wcs_simple.map M src/mapwcs.cpp Log Message: ----------- Bug: Fix memory leak on param handling (#7539) * Bug: Fix memory leak on param handling Signed-off-by: Arthur Chan * Fix linting Signed-off-by: Arthur Chan * Fix logic Signed-off-by: Arthur Chan * msautotest/wxs/wcs_simple.map: test duplicated parameter not to cause memory leak --------- Signed-off-by: Arthur Chan Co-authored-by: Even Rouault To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 3 06:22:59 2026 From: noreply at github.com (Even Rouault) Date: Fri, 03 Jul 2026 06:22:59 -0700 Subject: [mapserver-commits] [MapServer/MapServer] dcf090: Bug: Fix memory leak on param handling Message-ID: Branch: refs/heads/backport-7539-to-branch-8-6 Home: https://github.com/MapServer/MapServer Commit: dcf090fccd4599444a003c7cafdf9e99949ebc42 https://github.com/MapServer/MapServer/commit/dcf090fccd4599444a003c7cafdf9e99949ebc42 Author: Arthur Chan Date: 2026-07-03 (Fri, 03 Jul 2026) Changed paths: M src/mapwcs.cpp Log Message: ----------- Bug: Fix memory leak on param handling Signed-off-by: Arthur Chan Commit: a7849add206a342552a5e9719717f214cbe910ba https://github.com/MapServer/MapServer/commit/a7849add206a342552a5e9719717f214cbe910ba Author: Arthur Chan Date: 2026-07-03 (Fri, 03 Jul 2026) Changed paths: M src/mapwcs.cpp Log Message: ----------- Fix linting Signed-off-by: Arthur Chan Commit: fecbc686b401c056c6182bb6cda0f4c54df8c441 https://github.com/MapServer/MapServer/commit/fecbc686b401c056c6182bb6cda0f4c54df8c441 Author: Arthur Chan Date: 2026-07-03 (Fri, 03 Jul 2026) Changed paths: M src/mapwcs.cpp Log Message: ----------- Fix logic Signed-off-by: Arthur Chan Commit: 201db6e48afcd60277d8c51bd26a9fb92ef3747b https://github.com/MapServer/MapServer/commit/201db6e48afcd60277d8c51bd26a9fb92ef3747b Author: Even Rouault Date: 2026-07-03 (Fri, 03 Jul 2026) Changed paths: M msautotest/wxs/wcs_simple.map Log Message: ----------- msautotest/wxs/wcs_simple.map: test duplicated parameter not to cause memory leak Compare: https://github.com/MapServer/MapServer/compare/dcf090fccd45%5E...201db6e48afc To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 3 08:23:21 2026 From: noreply at github.com (github-actions[bot]) Date: Fri, 03 Jul 2026 08:23:21 -0700 Subject: [mapserver-commits] [MapServer/MapServer] 55f908: [Backport branch-8-6] Bug: Fix memory leak on para... Message-ID: Branch: refs/heads/branch-8-6 Home: https://github.com/MapServer/MapServer Commit: 55f908143926484635c680af38fa4b8c9e58070f https://github.com/MapServer/MapServer/commit/55f908143926484635c680af38fa4b8c9e58070f Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Date: 2026-07-03 (Fri, 03 Jul 2026) Changed paths: M msautotest/wxs/wcs_simple.map M src/mapwcs.cpp Log Message: ----------- [Backport branch-8-6] Bug: Fix memory leak on param handling (#7548) * Bug: Fix memory leak on param handling Signed-off-by: Arthur Chan * Fix linting Signed-off-by: Arthur Chan * Fix logic Signed-off-by: Arthur Chan * msautotest/wxs/wcs_simple.map: test duplicated parameter not to cause memory leak --------- Signed-off-by: Arthur Chan Co-authored-by: Arthur Chan Co-authored-by: Even Rouault To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 3 08:23:24 2026 From: noreply at github.com (Jeff McKenna) Date: Fri, 03 Jul 2026 08:23:24 -0700 Subject: [mapserver-commits] [MapServer/MapServer] Message-ID: Branch: refs/heads/backport-7539-to-branch-8-6 Home: https://github.com/MapServer/MapServer To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Mon Jul 6 07:05:41 2026 From: noreply at github.com (Naveed) Date: Mon, 06 Jul 2026 07:05:41 -0700 Subject: [mapserver-commits] [MapServer/MapServer] 7da05c: Merge pull request #7541 from nvxbug/gif-palette-b... Message-ID: Branch: refs/heads/main Home: https://github.com/MapServer/MapServer Commit: 7da05c7c7364a5cfbb7063e9bddd8139b903ab32 https://github.com/MapServer/MapServer/commit/7da05c7c7364a5cfbb7063e9bddd8139b903ab32 Author: Naveed Date: 2026-07-06 (Mon, 06 Jul 2026) Changed paths: A msautotest/misc/data/gif_no_colormap.gif A msautotest/misc/data/gif_palette_oob.gif A msautotest/renderers/expected/gif_no_colormap.txt A msautotest/renderers/expected/gif_palette_oob.txt A msautotest/renderers/gif_palette_bounds.map M msautotest/renderers/symbolset M src/mapimageio.c Log Message: ----------- Merge pull request #7541 from nvxbug/gif-palette-bounds bound gif palette index reads to the color table size To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Mon Jul 6 07:05:59 2026 From: noreply at github.com (Naveed) Date: Mon, 06 Jul 2026 07:05:59 -0700 Subject: [mapserver-commits] [MapServer/MapServer] 79cf5b: bound gif palette index reads to color table size Message-ID: Branch: refs/heads/backport-7541-to-branch-8-6 Home: https://github.com/MapServer/MapServer Commit: 79cf5b96b15fbff52a7efdcd82d172a46448563b https://github.com/MapServer/MapServer/commit/79cf5b96b15fbff52a7efdcd82d172a46448563b Author: Naveed Date: 2026-07-06 (Mon, 06 Jul 2026) Changed paths: M src/mapimageio.c Log Message: ----------- bound gif palette index reads to color table size Commit: 328a526f5ebde7599b997c826461f6228b5b8d18 https://github.com/MapServer/MapServer/commit/328a526f5ebde7599b997c826461f6228b5b8d18 Author: Naveed Date: 2026-07-06 (Mon, 06 Jul 2026) Changed paths: A msautotest/misc/data/gif_no_colormap.gif A msautotest/misc/data/gif_palette_oob.gif A msautotest/renderers/expected/gif_no_colormap.txt A msautotest/renderers/expected/gif_palette_oob.txt A msautotest/renderers/gif_palette_bounds.map M msautotest/renderers/symbolset Log Message: ----------- msautotest: regression test for out-of-bounds GIF palette reads Commit: 16bf4957ea747fd50e74fe45102bfff4f92f3eb7 https://github.com/MapServer/MapServer/commit/16bf4957ea747fd50e74fe45102bfff4f92f3eb7 Author: Naveed Date: 2026-07-06 (Mon, 06 Jul 2026) Changed paths: M src/mapimageio.c Log Message: ----------- readGIF: free buffers and close handle on error returns The no-colormap and img-size-exceeds-screen error paths returned without releasing the pixel buffer or the giflib handle, so the regression GIFs tripped LeakSanitizer under the ASAN test job. Release both before returning. Commit: b65e3ce60fda9f1d65515d406faccbe2ab4952a0 https://github.com/MapServer/MapServer/commit/b65e3ce60fda9f1d65515d406faccbe2ab4952a0 Author: Naveed Date: 2026-07-06 (Mon, 06 Jul 2026) Changed paths: M src/mapimageio.c Log Message: ----------- readGIF: route the final close through closeGIF Compare: https://github.com/MapServer/MapServer/compare/79cf5b96b15f%5E...b65e3ce60fda To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Tue Jul 7 01:55:20 2026 From: noreply at github.com (github-actions[bot]) Date: Tue, 07 Jul 2026 01:55:20 -0700 Subject: [mapserver-commits] [MapServer/MapServer] ca4d25: [Backport branch-8-6] bound gif palette index read... Message-ID: Branch: refs/heads/branch-8-6 Home: https://github.com/MapServer/MapServer Commit: ca4d255846f4f52ae79fec94bcbc34c7f545925a https://github.com/MapServer/MapServer/commit/ca4d255846f4f52ae79fec94bcbc34c7f545925a Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Date: 2026-07-07 (Tue, 07 Jul 2026) Changed paths: A msautotest/misc/data/gif_no_colormap.gif A msautotest/misc/data/gif_palette_oob.gif A msautotest/renderers/expected/gif_no_colormap.txt A msautotest/renderers/expected/gif_palette_oob.txt A msautotest/renderers/gif_palette_bounds.map M msautotest/renderers/symbolset M src/mapimageio.c Log Message: ----------- [Backport branch-8-6] bound gif palette index reads to the color table size (#7551) * bound gif palette index reads to color table size * msautotest: regression test for out-of-bounds GIF palette reads * readGIF: free buffers and close handle on error returns The no-colormap and img-size-exceeds-screen error paths returned without releasing the pixel buffer or the giflib handle, so the regression GIFs tripped LeakSanitizer under the ASAN test job. Release both before returning. * readGIF: route the final close through closeGIF --------- Co-authored-by: Naveed To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Tue Jul 7 01:55:22 2026 From: noreply at github.com (Even Rouault) Date: Tue, 07 Jul 2026 01:55:22 -0700 Subject: [mapserver-commits] [MapServer/MapServer] Message-ID: Branch: refs/heads/backport-7541-to-branch-8-6 Home: https://github.com/MapServer/MapServer To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Tue Jul 7 02:44:53 2026 From: noreply at github.com (Even Rouault) Date: Tue, 07 Jul 2026 02:44:53 -0700 Subject: [mapserver-commits] [MapServer/MapServer] f98502: bound quadtree shape ids to the shapefile record c... Message-ID: Branch: refs/heads/main Home: https://github.com/MapServer/MapServer Commit: f98502de99f1af36c22081c8ff6c694cbf04a4fc https://github.com/MapServer/MapServer/commit/f98502de99f1af36c22081c8ff6c694cbf04a4fc Author: Naveed Date: 2026-07-07 (Tue, 07 Jul 2026) Changed paths: M src/maptree.c Log Message: ----------- bound quadtree shape ids to the shapefile record count Commit: f9d60f9a4f50b8b7612cc1416e4df40587815d94 https://github.com/MapServer/MapServer/commit/f9d60f9a4f50b8b7612cc1416e4df40587815d94 Author: Even Rouault Date: 2026-07-07 (Tue, 07 Jul 2026) Changed paths: M src/maptree.c Log Message: ----------- Merge pull request #7552 from nvxbug/qix-shapeid-bounds bound quadtree shape ids to the shapefile record count Compare: https://github.com/MapServer/MapServer/compare/7da05c7c7364...f9d60f9a4f50 To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Tue Jul 7 02:45:08 2026 From: noreply at github.com (Naveed) Date: Tue, 07 Jul 2026 02:45:08 -0700 Subject: [mapserver-commits] [MapServer/MapServer] b93c18: bound quadtree shape ids to the shapefile record c... Message-ID: Branch: refs/heads/backport-7552-to-branch-8-6 Home: https://github.com/MapServer/MapServer Commit: b93c1859f3b8ebd3fae9477be32a73b191a314b9 https://github.com/MapServer/MapServer/commit/b93c1859f3b8ebd3fae9477be32a73b191a314b9 Author: Naveed Date: 2026-07-07 (Tue, 07 Jul 2026) Changed paths: M src/maptree.c Log Message: ----------- bound quadtree shape ids to the shapefile record count To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Tue Jul 7 02:46:40 2026 From: noreply at github.com (Even Rouault) Date: Tue, 07 Jul 2026 02:46:40 -0700 Subject: [mapserver-commits] [MapServer/MapServer] 2e4229: WMS OpenLayers output: escape angle brackets in ma... Message-ID: Branch: refs/heads/main Home: https://github.com/MapServer/MapServer Commit: 2e4229ff66f6eac1b270755a0ce0ce8debee4432 https://github.com/MapServer/MapServer/commit/2e4229ff66f6eac1b270755a0ce0ce8debee4432 Author: MarkLee131 Date: 2026-06-30 (Tue, 30 Jun 2026) Changed paths: M msautotest/pymod/mstestlib.py A msautotest/wxs/expected/wms_openlayers_xss.txt A msautotest/wxs/wms_openlayers_xss.map M src/maptemplate.c Log Message: ----------- WMS OpenLayers output: escape angle brackets in mapserv_onlineresource The GHSA-xqj6-vjqr-33vv fix only escaped the JS quote, so a literal in a forwarded host/proto header still closed the in a forwarded host/proto header still closed the in a forwarded host/proto header still closed the ) therefore produced reflected XSS on any zero-match OGC API Features items request. Parse and validate offset (integer, non-negative) unconditionally at the start of the bbox query path, so bad values are rejected with a 400 "Bad value for offset." error before any template is rendered. The upper-bound (offset >= numberMatched) range check stays where numberMatched is known. Behaviour for valid offsets is unchanged. Add an msautotest case that sends the XSS payload on a zero-match bbox with f=html and asserts the JSON 400 error, confirming the response is application/json rather than reflected text/html. Co-authored-by: Philip Garabandic Co-authored-by: Claude Opus 4.8 (1M context) To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 10 06:40:13 2026 From: noreply at github.com (Philip G.) Date: Fri, 10 Jul 2026 06:40:13 -0700 Subject: [mapserver-commits] [MapServer/MapServer] 47720e: OGC API Features: validate offset before rendering... Message-ID: Branch: refs/heads/branch-8-6 Home: https://github.com/MapServer/MapServer Commit: 47720e835de4d80a602210461d3b52c9f3d5c34c https://github.com/MapServer/MapServer/commit/47720e835de4d80a602210461d3b52c9f3d5c34c Author: Philip G. <44811794+PhilipPhil at users.noreply.github.com> Date: 2026-07-10 (Fri, 10 Jul 2026) Changed paths: A msautotest/api/expected/ogcapi_collections_mn_counties_items_offset_xss.json.txt M msautotest/api/ogcapi.map M src/mapogcapi.cpp Log Message: ----------- OGC API Features: validate offset before rendering to fix reflected XSS (GHSA-288j-mhpj-gmmr) (#7573) The "offset" query parameter was only parsed and validated inside the numberMatched > 0 branch of processCollectionItemsRequest(). When a bbox query matched zero features, that validation was skipped and the raw, unescaped value flowed into template.params.offset, which the HTML collection-items template renders directly into a ) therefore produced reflected XSS on any zero-match OGC API Features items request. Parse and validate offset (integer, non-negative) unconditionally at the start of the bbox query path, so bad values are rejected with a 400 "Bad value for offset." error before any template is rendered. The upper-bound (offset >= numberMatched) range check stays where numberMatched is known. Behaviour for valid offsets is unchanged. Add an msautotest case that sends the XSS payload on a zero-match bbox with f=html and asserts the JSON 400 error, confirming the response is application/json rather than reflected text/html. Co-authored-by: Philip Garabandic Co-authored-by: Claude Opus 4.8 (1M context) To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 10 07:00:12 2026 From: noreply at github.com (Jeff McKenna) Date: Fri, 10 Jul 2026 07:00:12 -0700 Subject: [mapserver-commits] [MapServer/MapServer] 3bfd00: fix backport of #7573 Message-ID: Branch: refs/heads/branch-8-6 Home: https://github.com/MapServer/MapServer Commit: 3bfd0071f74d55b43301ba57f8c4a1425789e0c4 https://github.com/MapServer/MapServer/commit/3bfd0071f74d55b43301ba57f8c4a1425789e0c4 Author: Jeff McKenna Date: 2026-07-10 (Fri, 10 Jul 2026) Changed paths: M src/mapogcapi.cpp Log Message: ----------- fix backport of #7573 To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 10 10:21:27 2026 From: noreply at github.com (Jeff McKenna) Date: Fri, 10 Jul 2026 10:21:27 -0700 Subject: [mapserver-commits] [MapServer/MapServer] Message-ID: Branch: refs/tags/rel-8-6-5 Home: https://github.com/MapServer/MapServer To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 10 10:21:28 2026 From: noreply at github.com (Jeff McKenna) Date: Fri, 10 Jul 2026 10:21:28 -0700 Subject: [mapserver-commits] [MapServer/MapServer] d25c31: update for 8.6.5 release Message-ID: Branch: refs/heads/branch-8-6 Home: https://github.com/MapServer/MapServer Commit: d25c31936f3f67911a56560e95ed2c8a7cb8ab4f https://github.com/MapServer/MapServer/commit/d25c31936f3f67911a56560e95ed2c8a7cb8ab4f Author: Jeff McKenna Date: 2026-07-10 (Fri, 10 Jul 2026) Changed paths: M CITATION.cff M CMakeLists.txt M HISTORY.md Log Message: ----------- update for 8.6.5 release To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 10 10:35:17 2026 From: noreply at github.com (Jeff McKenna) Date: Fri, 10 Jul 2026 10:35:17 -0700 Subject: [mapserver-commits] [MapServer/MapServer] eeed56: update for 8.6.5 release Message-ID: Branch: refs/heads/main Home: https://github.com/MapServer/MapServer Commit: eeed56ae4c6c691a56d511a883a64cb5abcbde22 https://github.com/MapServer/MapServer/commit/eeed56ae4c6c691a56d511a883a64cb5abcbde22 Author: Jeff McKenna Date: 2026-07-10 (Fri, 10 Jul 2026) Changed paths: M CITATION.cff M HISTORY.md Log Message: ----------- update for 8.6.5 release To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications From noreply at github.com Fri Jul 10 13:49:50 2026 From: noreply at github.com (Hermes) Date: Fri, 10 Jul 2026 13:49:50 -0700 Subject: [mapserver-commits] [MapServer/MapServer] 0c5ba1: Kriging (NNGP) interpolation layer (CONNECTIONTYPE... Message-ID: Branch: refs/heads/main Home: https://github.com/MapServer/MapServer Commit: 0c5ba141e4f98a8e5d9ab0ec168851c6b50fb87b https://github.com/MapServer/MapServer/commit/0c5ba141e4f98a8e5d9ab0ec168851c6b50fb87b Author: Hermes Date: 2026-07-10 (Fri, 10 Jul 2026) Changed paths: M CMakeLists.txt A msautotest/gdal/data/kriging_points.csv A msautotest/gdal/expected/kriging_mean.png A msautotest/gdal/expected/kriging_sd.png A msautotest/gdal/kriging.map M src/interpolation.c A src/kriging.c A src/kriging_nngp.h M src/mapfile.c M src/maplexer.c M src/maplexer.l M src/mapraster.c M src/maprasterquery.c M src/mapserver.h Log Message: ----------- Kriging (NNGP) interpolation layer (CONNECTIONTYPE kriging) (#7535) * Kriging: add NNGP interpolation layer (CONNECTIONTYPE kriging) Adds an ordinary-kriging interpolation layer implemented as a localized Nearest-Neighbor Gaussian Process: each output pixel is predicted from its m nearest samples, so cost scales with the neighbour count rather than the sample count. Emits two byte bands (predictive mean and the kriging standard error), selectable via PROCESSING "BANDS=n". The numeric core lives in src/kriging_nngp.h (pure C) and plugs into the existing interpolation framework alongside IDW and kernel density. Tunable through KRIGING_MODEL/TYPE/NEIGHBORS/RANGE/SILL/NUGGET. * Kriging: add CONNECTIONTYPE kriging lexer token Adds the "kriging" keyword to maplexer.l and regenerates maplexer.c with the project's flex invocation (flex --nounistd -Pmsyy -i). The large maplexer.c diff is the usual flex DFA-table reshuffle from introducing a new keyword. * Kriging: add msautotest coverage Adds msautotest/gdal/kriging.map exercising CONNECTIONTYPE kriging, the two-band (mean + std dev) output and the PROCESSING knobs over a small self-contained 16-point CSV. The surface is rendered by the vendored AGG with no fonts, so the expected images are platform-independent. --------- Co-authored-by: hermes.herrera To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications