[postgis-tickets] r17354 - MVT Geos: Avoid dereferencing a NULL pointer after validation

[Raul]

Author: algunenano
Date: 2019-03-22 04:23:43 -0700 (Fri, 22 Mar 2019)
New Revision: 17354

Modified:
   trunk/postgis/mvt.c
   trunk/regress/core/mvt.sql
   trunk/regress/core/mvt_expected
Log:
MVT Geos: Avoid dereferencing a NULL pointer after validation 

References #4348


Modified: trunk/postgis/mvt.c
===================================================================
--- trunk/postgis/mvt.c	2019-03-21 16:45:18 UTC (rev 17353)
+++ trunk/postgis/mvt.c	2019-03-22 11:23:43 UTC (rev 17354)
@@ -833,6 +833,7 @@
 	return geom_out;
 }
 
+/* Clips a geometry using lwgeom_clip_by_rect. Might return NULL */
 static LWGEOM *
 mvt_unsafe_clip_by_box(LWGEOM *lwg_in, GBOX *clip_box)
 {
@@ -866,6 +867,7 @@
  * It used to try to use GEOSClipByRect (as mvt_unsafe_clip_by_box) but since that produces
  * invalid output when an invalid geometry is given and detecting it resulted to be impossible,
  * we use intersection instead and, upon error, force validation of the input and retry.
+ * Might return NULL
  */
 static LWGEOM *
 mvt_safe_clip_polygon_by_box(LWGEOM *lwg_in, GBOX *clip_box)
@@ -944,6 +946,7 @@
  * Clips the geometry using GEOSIntersection in a "safe way", cleaning the input
  * if necessary and clipping MULTIPOLYGONs separately to reduce the impact
  * of using invalid input in GEOS
+ * Might return NULL
  */
 static LWGEOM *
 mvt_iterate_clip_by_box_geos(LWGEOM *lwgeom, GBOX *clip_gbox, uint8_t basic_type)
@@ -1068,6 +1071,9 @@
 	return ng;
 }
 
+/* Clips and validates a geometry for MVT using GEOS
+ * Might return NULL
+ */
 static LWGEOM *
 mvt_clip_and_validate_geos(LWGEOM *lwgeom, uint8_t basic_type, uint32_t extent, uint32_t buffer, bool clip_geom)
 {
@@ -1092,7 +1098,7 @@
 	ng = mvt_grid_and_validate_geos(ng, basic_type);
 
 	/* Make sure we return the expected type */
-	if (basic_type != lwgeom_get_basic_type(ng))
+	if (!ng || basic_type != lwgeom_get_basic_type(ng))
 	{
 		/* Drop type changes to play nice with MVT renderers */
 		POSTGIS_DEBUG(1, "mvt_geom: Dropping geometry after type change");

Modified: trunk/regress/core/mvt.sql
===================================================================
--- trunk/regress/core/mvt.sql	2019-03-21 16:45:18 UTC (rev 17353)
+++ trunk/regress/core/mvt.sql	2019-03-22 11:23:43 UTC (rev 17354)
@@ -716,3 +716,12 @@
     8,
     true
     ) IS NOT NULL;
+
+-- We are testing that GEOS backend doesn't crash, and returns NULL when it can't make the result valid according to the MVT spec
+SELECT '#4348Crash', COALESCE(ST_Npoints(ST_AsMVTGeom(
+    'MULTIPOLYGON(((-8229128.09556328 4988464.46336245,-8229128.40691213 4988456.8884978,-8229115.39548875 4988459.50357926,-8229115.13749806 4988448.99552612,-8229136.63574414 4988453.35736715,-8229129.08050392 4988453.18115239,-8229136.76790653 4988453.76438188,-8229135.67971702 4988464.64026597,-8229128.09556328 4988464.46336245)))'::geometry,
+    'POLYGON((-8230739.20574778 4989809.20645631,-8230739.20574778 4987363.22155118,-8228293.22084265 4987363.22155118,-8228293.22084265 4989809.20645631,-8230739.20574778 4989809.20645631))'::geometry,
+    4096,
+    16,
+    true
+)), 0) BETWEEN 0 AND 100;

Modified: trunk/regress/core/mvt_expected
===================================================================
--- trunk/regress/core/mvt_expected	2019-03-21 16:45:18 UTC (rev 17353)
+++ trunk/regress/core/mvt_expected	2019-03-22 11:23:43 UTC (rev 17354)
@@ -141,3 +141,4 @@
 #4348ReversedSmall|t
 #4348Reversed2|t
 #4348Point|t
+#4348Crash|t