[mapserver-commits] [MapServer/MapServer] b175c3: maperror: size the error image within MAXSIZE (GHS...

[Kaixuan Li]

  Branch: refs/heads/backport-7625-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: b175c3dd2bf2c3038db3bcd72669e577a2e346ca
      https://github.com/MapServer/MapServer/commit/b175c3dd2bf2c3038db3bcd72669e577a2e346ca
  Author: Kaixuan Li <kaixuan.li at ntu.edu.sg>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_get_map_oversized_exception_inimage.png
    M msautotest/wxs/wms_simple.map
    M src/maperror.c

  Log Message:
  -----------
  maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w)

msWMSLoadGetMapParams() stores WIDTH/HEIGHT into map->width/map->height as
soon as they are parsed, but only validates them against MAXSIZE much later.
Several exceptions are raised in between, so an in-image exception could be
rendered at the unvalidated request dimensions, letting one unauthenticated
GetMap ask for an arbitrarily large allocation.

msWriteErrorImage() now falls back to 400x300 unless the map dimensions are
within MAXSIZE, which covers every early-exit path, and checks msImageCreate()
for NULL so a refused allocation no longer segfaults while reporting an error.


  Commit: 2e4330a53231e1308980e15066f14589e1311f1d
      https://github.com/MapServer/MapServer/commit/2e4330a53231e1308980e15066f14589e1311f1d
  Author: Kaixuan Li <kaixuan.li at ntu.edu.sg>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    M src/maperror.c

  Log Message:
  -----------
  maperror: explain why the NULL-image path leaves the errors unreported

Review question on #7625: the early return skips the isreported loop and the
headers on purpose, so msCGIWriteError() still produces an error page.


  Commit: e27cfe6d00542ea4cc428076d813e7ab1882e7d0
      https://github.com/MapServer/MapServer/commit/e27cfe6d00542ea4cc428076d813e7ab1882e7d0
  Author: MarkLee131 <kaixuan.li at ntu.edu.sg>
  Date:   2026-09-06 (Sun, 06 Sep 2026)

  Changed paths:
    A msautotest/wxs/expected/wms_get_map_small_exception_inimage.png
    M msautotest/wxs/wms_simple.map
    M src/maperror.c

  Log Message:
  -----------
  maperror: keep the error image wide enough to split the message

Review on #7625: a request such as WIDTH=10&HEIGHT=10&EXCEPTIONS=INIMAGE
leaves no usable width between the 5 pixel margins, so nMaxCharsPerLine is 0
and the line count becomes ceil(nTextLength / 0.0). Casting that infinity to
int is undefined behaviour; it lands on INT_MIN on x86-64, where the loops
below are simply skipped, but saturates to INT_MAX on targets with saturating
conversions, which then asks for a 17 GB allocation and writes through the
NULL it gets back.

Only adopt the requested size when it also has room for one character between
the margins, so the 400x300 fallback covers every width the error text cannot
be laid out on. Widths of 10 to 14 reported by UBSan before the change are
clean after it.


Compare: https://github.com/MapServer/MapServer/compare/b175c3dd2bf2%5E...e27cfe6d0054

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications