From noreply at github.com  Tue Sep  1 22:57:36 2026
From: noreply at github.com (Arthur Chan)
Date: Tue, 01 Sep 2026 22:57:36 -0700
Subject: [mapserver-commits] [MapServer/MapServer] fd716b: Fix memleak in
 mapogcsld (#7637)
Message-ID: <MapServer/MapServer/push/refs/heads/main/f157d2-fd716b@github.com>

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: fd716b1e1302eb9f7ef9439f6af0a8c3ae813839
      https://github.com/MapServer/MapServer/commit/fd716b1e1302eb9f7ef9439f6af0a8c3ae813839
  Author: Arthur Chan <arthur.chan at adalogics.com>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M src/mapogcsld.cpp

  Log Message:
  -----------
  Fix memleak in mapogcsld (#7637)

Signed-off-by: Arthur Chan <arthur.chan at adalogics.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Tue Sep  1 22:57:52 2026
From: noreply at github.com (Arthur Chan)
Date: Tue, 01 Sep 2026 22:57:52 -0700
Subject: [mapserver-commits] [MapServer/MapServer] bb5a42: Fix memleak in
 mapogcsld
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7637-to-branch-8-6/000000-bb5a42@github.com>

  Branch: refs/heads/backport-7637-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: bb5a425b072141cfd62e78dc1ac1b9125e797122
      https://github.com/MapServer/MapServer/commit/bb5a425b072141cfd62e78dc1ac1b9125e797122
  Author: Arthur Chan <arthur.chan at adalogics.com>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M src/mapogcsld.cpp

  Log Message:
  -----------
  Fix memleak in mapogcsld

Signed-off-by: Arthur Chan <arthur.chan at adalogics.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Wed Sep  2 05:09:37 2026
From: noreply at github.com (Naveed)
Date: Wed, 02 Sep 2026 05:09:37 -0700
Subject: [mapserver-commits] [MapServer/MapServer] f1b87f: kml: use snprintf
 when formatting coordinates, ext...
Message-ID: <MapServer/MapServer/push/refs/heads/main/fd716b-f1b87f@github.com>

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: f1b87fad7c7085b2fea932d3566e6c902406eb3f
      https://github.com/MapServer/MapServer/commit/f1b87fad7c7085b2fea932d3566e6c902406eb3f
  Author: Naveed <naveed at bugqore.com>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_kml_bigcoord.kml
    A msautotest/wxs/wms_kml_bigcoord.map
    M src/mapkmlrenderer.cpp

  Log Message:
  -----------
  kml: use snprintf when formatting coordinates, extents and widths (#7630)



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Wed Sep  2 05:10:28 2026
From: noreply at github.com (Naveed)
Date: Wed, 02 Sep 2026 05:10:28 -0700
Subject: [mapserver-commits] [MapServer/MapServer] 4e5239: kml: use snprintf
 when formatting coordinates, ext...
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7630-to-branch-8-6/000000-4e5239@github.com>

  Branch: refs/heads/backport-7630-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: 4e523997e1e0ea100575b4ec3482a2eac8c7d99f
      https://github.com/MapServer/MapServer/commit/4e523997e1e0ea100575b4ec3482a2eac8c7d99f
  Author: Naveed <naveed at bugqore.com>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_kml_bigcoord.kml
    A msautotest/wxs/wms_kml_bigcoord.map
    M src/mapkmlrenderer.cpp

  Log Message:
  -----------
  kml: use snprintf when formatting coordinates, extents and widths



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Wed Sep  2 05:38:33 2026
From: noreply at github.com (github-actions[bot])
Date: Wed, 02 Sep 2026 05:38:33 -0700
Subject: [mapserver-commits] [MapServer/MapServer] a3c3f6: Fix memleak in
 mapogcsld (#7638)
Message-ID: <MapServer/MapServer/push/refs/heads/branch-8-6/e5b433-a3c3f6@github.com>

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: a3c3f682e12d87c2d241ab67f32bdc6772c45df2
      https://github.com/MapServer/MapServer/commit/a3c3f682e12d87c2d241ab67f32bdc6772c45df2
  Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M src/mapogcsld.cpp

  Log Message:
  -----------
  Fix memleak in mapogcsld (#7638)

Signed-off-by: Arthur Chan <arthur.chan at adalogics.com>
Co-authored-by: Arthur Chan <arthur.chan at adalogics.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Wed Sep  2 05:38:35 2026
From: noreply at github.com (Jeff McKenna)
Date: Wed, 02 Sep 2026 05:38:35 -0700
Subject: [mapserver-commits] [MapServer/MapServer]
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7637-to-branch-8-6/bb5a42-000000@github.com>

  Branch: refs/heads/backport-7637-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Thu Sep  3 05:54:01 2026
From: noreply at github.com (Jeff McKenna)
Date: Thu, 03 Sep 2026 05:54:01 -0700
Subject: [mapserver-commits] [MapServer/MapServer] e919a7: CI: upgrade PCRE2
 to 10.48 release (#7640)
Message-ID: <MapServer/MapServer/push/refs/heads/main/f1b87f-e919a7@github.com>

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: e919a717953c2458b3e44699f4eb4b2118f86006
      https://github.com/MapServer/MapServer/commit/e919a717953c2458b3e44699f4eb4b2118f86006
  Author: Jeff McKenna <jmckenna at gatewaygeomatics.com>
  Date:   2026-09-03 (Thu, 03 Sep 2026)

  Changed paths:
    M ci/ubuntu/setup.sh
    M msautotest/php/README.md
    M src/mapscript/README.md
    M src/mapscript/php/README.md

  Log Message:
  -----------
  CI: upgrade PCRE2 to 10.48 release (#7640)



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Thu Sep  3 05:54:19 2026
From: noreply at github.com (Jeff McKenna)
Date: Thu, 03 Sep 2026 05:54:19 -0700
Subject: [mapserver-commits] [MapServer/MapServer] c433ec: CI: upgrade PCRE2
 to 10.48 release
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7640-to-branch-8-6/000000-f27102@github.com>

  Branch: refs/heads/backport-7640-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: c433ecbf38fb51f5757b828352db8b783409048d
      https://github.com/MapServer/MapServer/commit/c433ecbf38fb51f5757b828352db8b783409048d
  Author: Jeff McKenna <jmckenna at gatewaygeomatics.com>
  Date:   2026-09-03 (Thu, 03 Sep 2026)

  Changed paths:
    M ci/ubuntu/setup.sh

  Log Message:
  -----------
  CI: upgrade PCRE2 to 10.48 release


  Commit: c2d4829bec9689d1bc87ce7cb11b53c639f47389
      https://github.com/MapServer/MapServer/commit/c2d4829bec9689d1bc87ce7cb11b53c639f47389
  Author: Jeff McKenna <jmckenna at gatewaygeomatics.com>
  Date:   2026-09-03 (Thu, 03 Sep 2026)

  Changed paths:
    M msautotest/php/README.md
    M src/mapscript/php/README.md

  Log Message:
  -----------
  update PHP SWIG API link


  Commit: f27102409777246b499277879c47e80502c25fa0
      https://github.com/MapServer/MapServer/commit/f27102409777246b499277879c47e80502c25fa0
  Author: Jeff McKenna <jmckenna at gatewaygeomatics.com>
  Date:   2026-09-03 (Thu, 03 Sep 2026)

  Changed paths:
    M src/mapscript/README.md

  Log Message:
  -----------
  update PHP SWIG API link


Compare: https://github.com/MapServer/MapServer/compare/c433ecbf38fb%5E...f27102409777

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Thu Sep  3 08:34:01 2026
From: noreply at github.com (github-actions[bot])
Date: Thu, 03 Sep 2026 08:34:01 -0700
Subject: [mapserver-commits] [MapServer/MapServer] 33e961: [Backport
 branch-8-6] CI: upgrade PCRE2 to 10.48 r...
Message-ID: <MapServer/MapServer/push/refs/heads/branch-8-6/a3c3f6-33e961@github.com>

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: 33e961049cb416912ee4c88ddb874d07ca73d61f
      https://github.com/MapServer/MapServer/commit/33e961049cb416912ee4c88ddb874d07ca73d61f
  Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  Date:   2026-09-03 (Thu, 03 Sep 2026)

  Changed paths:
    M ci/ubuntu/setup.sh
    M msautotest/php/README.md
    M src/mapscript/README.md
    M src/mapscript/php/README.md

  Log Message:
  -----------
  [Backport branch-8-6] CI: upgrade PCRE2 to 10.48 release (#7641)

* CI: upgrade PCRE2 to 10.48 release

* update PHP SWIG API link

* update PHP SWIG API link

---------

Co-authored-by: Jeff McKenna <jmckenna at gatewaygeomatics.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Thu Sep  3 08:34:03 2026
From: noreply at github.com (Jeff McKenna)
Date: Thu, 03 Sep 2026 08:34:03 -0700
Subject: [mapserver-commits] [MapServer/MapServer]
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7640-to-branch-8-6/f27102-000000@github.com>

  Branch: refs/heads/backport-7640-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Fri Sep  4 12:26:27 2026
From: noreply at github.com (github-actions[bot])
Date: Fri, 04 Sep 2026 12:26:27 -0700
Subject: [mapserver-commits] [MapServer/MapServer] c15038: kml: use snprintf
 when formatting coordinates, ext...
Message-ID: <MapServer/MapServer/push/refs/heads/branch-8-6/33e961-c15038@github.com>

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: c1503886cfebc4be18accec43ecf4381ed1e0238
      https://github.com/MapServer/MapServer/commit/c1503886cfebc4be18accec43ecf4381ed1e0238
  Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  Date:   2026-09-04 (Fri, 04 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_kml_bigcoord.kml
    A msautotest/wxs/wms_kml_bigcoord.map
    M src/mapkmlrenderer.cpp

  Log Message:
  -----------
  kml: use snprintf when formatting coordinates, extents and widths (#7639)

Co-authored-by: Naveed <naveed at bugqore.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Fri Sep  4 12:26:29 2026
From: noreply at github.com (Jeff McKenna)
Date: Fri, 04 Sep 2026 12:26:29 -0700
Subject: [mapserver-commits] [MapServer/MapServer]
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7630-to-branch-8-6/4e5239-000000@github.com>

  Branch: refs/heads/backport-7630-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 03:05:58 2026
From: noreply at github.com (Kaixuan Li)
Date: Sun, 06 Sep 2026 03:05:58 -0700
Subject: [mapserver-commits] [MapServer/MapServer] 05e308: maperror: size
 the error image within MAXSIZE (GHS...
Message-ID: <MapServer/MapServer/push/refs/heads/main/e919a7-05e308@github.com>

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: 05e3089ee12b7e527b415dda00046d8e5be01f3d
      https://github.com/MapServer/MapServer/commit/05e3089ee12b7e527b415dda00046d8e5be01f3d
  Author: Kaixuan Li <kaixuan.li at ntu.edu.sg>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_get_map_oversized_exception_inimage.png
    A msautotest/wxs/expected/wms_get_map_small_exception_inimage.png
    M msautotest/wxs/wms_simple.map
    M src/maperror.c

  Log Message:
  -----------
  maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w) (#7625)

* maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w)

msWMSLoadGetMapParams() stores WIDTH/HEIGHT into map->width/map->height as
soon as they are parsed, but only validates them against MAXSIZE much later.
Several exceptions are raised in between, so an in-image exception could be
rendered at the unvalidated request dimensions, letting one unauthenticated
GetMap ask for an arbitrarily large allocation.

msWriteErrorImage() now falls back to 400x300 unless the map dimensions are
within MAXSIZE, which covers every early-exit path, and checks msImageCreate()
for NULL so a refused allocation no longer segfaults while reporting an error.

* maperror: explain why the NULL-image path leaves the errors unreported

Review question on #7625: the early return skips the isreported loop and the
headers on purpose, so msCGIWriteError() still produces an error page.

* maperror: keep the error image wide enough to split the message

Review on #7625: a request such as WIDTH=10&HEIGHT=10&EXCEPTIONS=INIMAGE
leaves no usable width between the 5 pixel margins, so nMaxCharsPerLine is 0
and the line count becomes ceil(nTextLength / 0.0). Casting that infinity to
int is undefined behaviour; it lands on INT_MIN on x86-64, where the loops
below are simply skipped, but saturates to INT_MAX on targets with saturating
conversions, which then asks for a 17 GB allocation and writes through the
NULL it gets back.

Only adopt the requested size when it also has room for one character between
the margins, so the 400x300 fallback covers every width the error text cannot
be laid out on. Widths of 10 to 14 reported by UBSan before the change are
clean after it.



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 03:06:13 2026
From: noreply at github.com (Kaixuan Li)
Date: Sun, 06 Sep 2026 03:06:13 -0700
Subject: [mapserver-commits] [MapServer/MapServer] b175c3: maperror: size
 the error image within MAXSIZE (GHS...
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7625-to-branch-8-6/000000-e27cfe@github.com>

  Branch: refs/heads/backport-7625-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: b175c3dd2bf2c3038db3bcd72669e577a2e346ca
      https://github.com/MapServer/MapServer/commit/b175c3dd2bf2c3038db3bcd72669e577a2e346ca
  Author: Kaixuan Li <kaixuan.li at ntu.edu.sg>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_get_map_oversized_exception_inimage.png
    M msautotest/wxs/wms_simple.map
    M src/maperror.c

  Log Message:
  -----------
  maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w)

msWMSLoadGetMapParams() stores WIDTH/HEIGHT into map->width/map->height as
soon as they are parsed, but only validates them against MAXSIZE much later.
Several exceptions are raised in between, so an in-image exception could be
rendered at the unvalidated request dimensions, letting one unauthenticated
GetMap ask for an arbitrarily large allocation.

msWriteErrorImage() now falls back to 400x300 unless the map dimensions are
within MAXSIZE, which covers every early-exit path, and checks msImageCreate()
for NULL so a refused allocation no longer segfaults while reporting an error.


  Commit: 2e4330a53231e1308980e15066f14589e1311f1d
      https://github.com/MapServer/MapServer/commit/2e4330a53231e1308980e15066f14589e1311f1d
  Author: Kaixuan Li <kaixuan.li at ntu.edu.sg>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    M src/maperror.c

  Log Message:
  -----------
  maperror: explain why the NULL-image path leaves the errors unreported

Review question on #7625: the early return skips the isreported loop and the
headers on purpose, so msCGIWriteError() still produces an error page.


  Commit: e27cfe6d00542ea4cc428076d813e7ab1882e7d0
      https://github.com/MapServer/MapServer/commit/e27cfe6d00542ea4cc428076d813e7ab1882e7d0
  Author: MarkLee131 <kaixuan.li at ntu.edu.sg>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_get_map_small_exception_inimage.png
    M msautotest/wxs/wms_simple.map
    M src/maperror.c

  Log Message:
  -----------
  maperror: keep the error image wide enough to split the message

Review on #7625: a request such as WIDTH=10&HEIGHT=10&EXCEPTIONS=INIMAGE
leaves no usable width between the 5 pixel margins, so nMaxCharsPerLine is 0
and the line count becomes ceil(nTextLength / 0.0). Casting that infinity to
int is undefined behaviour; it lands on INT_MIN on x86-64, where the loops
below are simply skipped, but saturates to INT_MAX on targets with saturating
conversions, which then asks for a 17 GB allocation and writes through the
NULL it gets back.

Only adopt the requested size when it also has room for one character between
the margins, so the 400x300 fallback covers every width the error text cannot
be laid out on. Widths of 10 to 14 reported by UBSan before the change are
clean after it.


Compare: https://github.com/MapServer/MapServer/compare/b175c3dd2bf2%5E...e27cfe6d0054

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 03:06:54 2026
From: noreply at github.com (Naveed)
Date: Sun, 06 Sep 2026 03:06:54 -0700
Subject: [mapserver-commits] [MapServer/MapServer] a74286: mapcontext: fix
 out-of-bounds read on short Boundi...
Message-ID: <MapServer/MapServer/push/refs/heads/main/05e308-a74286@github.com>

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: a74286adb2690f1ee9fadc76307b35761d467d38
      https://github.com/MapServer/MapServer/commit/a74286adb2690f1ee9fadc76307b35761d467d38
  Author: Naveed <naveed at bugqore.com>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/ows_context_bad_srs_caps.xml
    M msautotest/wxs/ows_context.map
    A msautotest/wxs/ows_context_bad_srs.xml
    M src/mapcontext.c

  Log Message:
  -----------
  mapcontext: fix out-of-bounds read on short BoundingBox SRS (#7642)

The General.BoundingBox.SRS value from a Web Map Context document was
only checked against the "AUTO:" prefix before stripping 5 bytes with
pszValue + 5, so an SRS shorter than the assumed "EPSG:" prefix read
past the end of the value. Strip only when the value starts with
"EPSG:", otherwise pass it through unchanged.



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 03:07:09 2026
From: noreply at github.com (Naveed)
Date: Sun, 06 Sep 2026 03:07:09 -0700
Subject: [mapserver-commits] [MapServer/MapServer] 411e46: mapcontext: fix
 out-of-bounds read on short Boundi...
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7642-to-branch-8-6/000000-411e46@github.com>

  Branch: refs/heads/backport-7642-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: 411e46c9cab36cfa6f43bb2956a40b6b787117f5
      https://github.com/MapServer/MapServer/commit/411e46c9cab36cfa6f43bb2956a40b6b787117f5
  Author: Naveed <naveed at bugqore.com>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/ows_context_bad_srs_caps.xml
    M msautotest/wxs/ows_context.map
    A msautotest/wxs/ows_context_bad_srs.xml
    M src/mapcontext.c

  Log Message:
  -----------
  mapcontext: fix out-of-bounds read on short BoundingBox SRS

The General.BoundingBox.SRS value from a Web Map Context document was
only checked against the "AUTO:" prefix before stripping 5 bytes with
pszValue + 5, so an SRS shorter than the assumed "EPSG:" prefix read
past the end of the value. Strip only when the value starts with
"EPSG:", otherwise pass it through unchanged.



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 05:39:51 2026
From: noreply at github.com (github-actions[bot])
Date: Sun, 06 Sep 2026 05:39:51 -0700
Subject: [mapserver-commits] [MapServer/MapServer] bf71dc: [Backport
 branch-8-6] maperror: size the error ima...
Message-ID: <MapServer/MapServer/push/refs/heads/branch-8-6/c15038-bf71dc@github.com>

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: bf71dcf46fa66c544f338614eb2187a75105b504
      https://github.com/MapServer/MapServer/commit/bf71dcf46fa66c544f338614eb2187a75105b504
  Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_get_map_oversized_exception_inimage.png
    A msautotest/wxs/expected/wms_get_map_small_exception_inimage.png
    M msautotest/wxs/wms_simple.map
    M src/maperror.c

  Log Message:
  -----------
  [Backport branch-8-6] maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w) (#7643)

* maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w)

msWMSLoadGetMapParams() stores WIDTH/HEIGHT into map->width/map->height as
soon as they are parsed, but only validates them against MAXSIZE much later.
Several exceptions are raised in between, so an in-image exception could be
rendered at the unvalidated request dimensions, letting one unauthenticated
GetMap ask for an arbitrarily large allocation.

msWriteErrorImage() now falls back to 400x300 unless the map dimensions are
within MAXSIZE, which covers every early-exit path, and checks msImageCreate()
for NULL so a refused allocation no longer segfaults while reporting an error.

* maperror: explain why the NULL-image path leaves the errors unreported

Review question on #7625: the early return skips the isreported loop and the
headers on purpose, so msCGIWriteError() still produces an error page.

* maperror: keep the error image wide enough to split the message

Review on #7625: a request such as WIDTH=10&HEIGHT=10&EXCEPTIONS=INIMAGE
leaves no usable width between the 5 pixel margins, so nMaxCharsPerLine is 0
and the line count becomes ceil(nTextLength / 0.0). Casting that infinity to
int is undefined behaviour; it lands on INT_MIN on x86-64, where the loops
below are simply skipped, but saturates to INT_MAX on targets with saturating
conversions, which then asks for a 17 GB allocation and writes through the
NULL it gets back.

Only adopt the requested size when it also has room for one character between
the margins, so the 400x300 fallback covers every width the error text cannot
be laid out on. Widths of 10 to 14 reported by UBSan before the change are
clean after it.

---------

Co-authored-by: Kaixuan Li <kaixuan.li at ntu.edu.sg>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 05:39:54 2026
From: noreply at github.com (Jeff McKenna)
Date: Sun, 06 Sep 2026 05:39:54 -0700
Subject: [mapserver-commits] [MapServer/MapServer]
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7625-to-branch-8-6/e27cfe-000000@github.com>

  Branch: refs/heads/backport-7625-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 08:19:43 2026
From: noreply at github.com (Jeff McKenna)
Date: Sun, 06 Sep 2026 08:19:43 -0700
Subject: [mapserver-commits] [MapServer/MapServer] cd6452: update formatting
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7642-to-branch-8-6/411e46-cd6452@github.com>

  Branch: refs/heads/backport-7642-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: cd6452f3e9392b6076978cd46b27e1bd390f2ef7
      https://github.com/MapServer/MapServer/commit/cd6452f3e9392b6076978cd46b27e1bd390f2ef7
  Author: Jeff McKenna <jmckenna at gatewaygeomatics.com>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    M msautotest/wxs/expected/ows_context_bad_srs_caps.xml

  Log Message:
  -----------
  update formatting



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 09:58:35 2026
From: noreply at github.com (github-actions[bot])
Date: Sun, 06 Sep 2026 09:58:35 -0700
Subject: [mapserver-commits] [MapServer/MapServer] 548180: [Backport
 branch-8-6] mapcontext: fix out-of-bound...
Message-ID: <MapServer/MapServer/push/refs/heads/branch-8-6/bf71dc-548180@github.com>

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: 548180af3063ceaa74004e8394c82772d5fa7c2a
      https://github.com/MapServer/MapServer/commit/548180af3063ceaa74004e8394c82772d5fa7c2a
  Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/ows_context_bad_srs_caps.xml
    M msautotest/wxs/ows_context.map
    A msautotest/wxs/ows_context_bad_srs.xml
    M src/mapcontext.c

  Log Message:
  -----------
  [Backport branch-8-6] mapcontext: fix out-of-bounds read on short BoundingBox SRS (#7644)

* mapcontext: fix out-of-bounds read on short BoundingBox SRS

The General.BoundingBox.SRS value from a Web Map Context document was
only checked against the "AUTO:" prefix before stripping 5 bytes with
pszValue + 5, so an SRS shorter than the assumed "EPSG:" prefix read
past the end of the value. Strip only when the value starts with
"EPSG:", otherwise pass it through unchanged.

* update formatting

---------

Co-authored-by: Naveed <naveed at bugqore.com>
Co-authored-by: Jeff McKenna <jmckenna at gatewaygeomatics.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 09:58:38 2026
From: noreply at github.com (Jeff McKenna)
Date: Sun, 06 Sep 2026 09:58:38 -0700
Subject: [mapserver-commits] [MapServer/MapServer]
Message-ID: <MapServer/MapServer/push/refs/heads/backport-7642-to-branch-8-6/cd6452-000000@github.com>

  Branch: refs/heads/backport-7642-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 10:44:50 2026
From: noreply at github.com (Jeff McKenna)
Date: Sun, 06 Sep 2026 10:44:50 -0700
Subject: [mapserver-commits] [MapServer/MapServer]
Message-ID: <MapServer/MapServer/push/refs/tags/rel-8-6-6/000000-51f163@github.com>

  Branch: refs/tags/rel-8-6-6
  Home:   https://github.com/MapServer/MapServer

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 10:44:50 2026
From: noreply at github.com (Jeff McKenna)
Date: Sun, 06 Sep 2026 10:44:50 -0700
Subject: [mapserver-commits] [MapServer/MapServer] 7515cc: update for 8.6.6
 release
Message-ID: <MapServer/MapServer/push/refs/heads/branch-8-6/548180-7515cc@github.com>

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: 7515cccfe75fb7554ea45bc87ba5eb4b6126db5d
      https://github.com/MapServer/MapServer/commit/7515cccfe75fb7554ea45bc87ba5eb4b6126db5d
  Author: Jeff McKenna <jmckenna at gatewaygeomatics.com>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    M CITATION.cff
    M CMakeLists.txt
    M HISTORY.md

  Log Message:
  -----------
  update for 8.6.6 release



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications

From noreply at github.com  Sun Sep  6 11:05:03 2026
From: noreply at github.com (Jeff McKenna)
Date: Sun, 06 Sep 2026 11:05:03 -0700
Subject: [mapserver-commits] [MapServer/MapServer] 77daef: update for 8.6.6
 release
Message-ID: <MapServer/MapServer/push/refs/heads/main/a74286-77daef@github.com>

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: 77daef94df831038e99a5e0bc1b6f0112ca4f6e5
      https://github.com/MapServer/MapServer/commit/77daef94df831038e99a5e0bc1b6f0112ca4f6e5
  Author: Jeff McKenna <jmckenna at gatewaygeomatics.com>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    M CITATION.cff
    M HISTORY.md

  Log Message:
  -----------
  update for 8.6.6 release



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications