[mapserver-commits] [MapServer/MapServer] 05e308: maperror: size the error image within MAXSIZE (GHS...

[Kaixuan Li]

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: 05e3089ee12b7e527b415dda00046d8e5be01f3d
      https://github.com/MapServer/MapServer/commit/05e3089ee12b7e527b415dda00046d8e5be01f3d
  Author: Kaixuan Li <kaixuan.li at ntu.edu.sg>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_get_map_oversized_exception_inimage.png
    A msautotest/wxs/expected/wms_get_map_small_exception_inimage.png
    M msautotest/wxs/wms_simple.map
    M src/maperror.c

  Log Message:
  -----------
  maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w) (#7625)

* maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w)

msWMSLoadGetMapParams() stores WIDTH/HEIGHT into map->width/map->height as
soon as they are parsed, but only validates them against MAXSIZE much later.
Several exceptions are raised in between, so an in-image exception could be
rendered at the unvalidated request dimensions, letting one unauthenticated
GetMap ask for an arbitrarily large allocation.

msWriteErrorImage() now falls back to 400x300 unless the map dimensions are
within MAXSIZE, which covers every early-exit path, and checks msImageCreate()
for NULL so a refused allocation no longer segfaults while reporting an error.

* maperror: explain why the NULL-image path leaves the errors unreported

Review question on #7625: the early return skips the isreported loop and the
headers on purpose, so msCGIWriteError() still produces an error page.

* maperror: keep the error image wide enough to split the message

Review on #7625: a request such as WIDTH=10&HEIGHT=10&EXCEPTIONS=INIMAGE
leaves no usable width between the 5 pixel margins, so nMaxCharsPerLine is 0
and the line count becomes ceil(nTextLength / 0.0). Casting that infinity to
int is undefined behaviour; it lands on INT_MIN on x86-64, where the loops
below are simply skipped, but saturates to INT_MAX on targets with saturating
conversions, which then asks for a 17 GB allocation and writes through the
NULL it gets back.

Only adopt the requested size when it also has room for one character between
the margins, so the 400x300 fallback covers every width the error text cannot
be laid out on. Widths of 10 to 14 reported by UBSan before the change are
clean after it.



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications