[postgis-tickets] r17355 - MVT Geos: Avoid dereferencing a NULL pointer after validation

[Raul]

Author: algunenano
Date: 2019-03-22 04:26:09 -0700 (Fri, 22 Mar 2019)
New Revision: 17355

Modified:
   branches/2.5/postgis/mvt.c
   branches/2.5/regress/mvt.sql
   branches/2.5/regress/mvt_expected
Log:
MVT Geos: Avoid dereferencing a NULL pointer after validation 

References #4348


Modified: branches/2.5/postgis/mvt.c
===================================================================
--- branches/2.5/postgis/mvt.c	2019-03-22 11:23:43 UTC (rev 17354)
+++ branches/2.5/postgis/mvt.c	2019-03-22 11:26:09 UTC (rev 17355)
@@ -791,6 +791,7 @@
 	return geom_out;
 }
 
+/* Clips a geometry using lwgeom_clip_by_rect. Might return NULL */
 static LWGEOM *
 mvt_unsafe_clip_by_box(LWGEOM *lwg_in, GBOX *clip_box)
 {
@@ -824,6 +825,7 @@
  * It used to try to use GEOSClipByRect (as mvt_unsafe_clip_by_box) but since that produces
  * invalid output when an invalid geometry is given and detecting it resulted to be impossible,
  * we use intersection instead and, upon error, force validation of the input and retry.
+ * Might return NULL
  */
 static LWGEOM *
 mvt_safe_clip_polygon_by_box(LWGEOM *lwg_in, GBOX *clip_box)
@@ -902,6 +904,7 @@
  * Clips the geometry using GEOSIntersection in a "safe way", cleaning the input
  * if necessary and clipping MULTIPOLYGONs separately to reduce the impact
  * of using invalid input in GEOS
+ * Might return NULL
  */
 static LWGEOM *
 mvt_iterate_clip_by_box_geos(LWGEOM *lwgeom, GBOX *clip_gbox, uint8_t basic_type)
@@ -1026,6 +1029,9 @@
 	return ng;
 }
 
+/* Clips and validates a geometry for MVT using GEOS
+ * Might return NULL
+ */
 static LWGEOM *
 mvt_clip_and_validate_geos(LWGEOM *lwgeom, uint8_t basic_type, uint32_t extent, uint32_t buffer, bool clip_geom)
 {
@@ -1050,7 +1056,7 @@
 	ng = mvt_grid_and_validate_geos(ng, basic_type);
 
 	/* Make sure we return the expected type */
-	if (basic_type != lwgeom_get_basic_type(ng))
+	if (!ng || basic_type != lwgeom_get_basic_type(ng))
 	{
 		/* Drop type changes to play nice with MVT renderers */
 		POSTGIS_DEBUG(1, "mvt_geom: Dropping geometry after type change");

Modified: branches/2.5/regress/mvt.sql
===================================================================
--- branches/2.5/regress/mvt.sql	2019-03-22 11:23:43 UTC (rev 17354)
+++ branches/2.5/regress/mvt.sql	2019-03-22 11:26:09 UTC (rev 17355)
@@ -646,4 +646,13 @@
     2048,
     8,
     true
-    ) IS NOT NULL;
\ No newline at end of file
+    ) IS NOT NULL;
+
+-- We are testing that GEOS backend doesn't crash, and returns NULL when it can't make the result valid according to the MVT spec
+SELECT '#4348Crash', COALESCE(ST_Npoints(ST_AsMVTGeom(
+    'MULTIPOLYGON(((-8229128.09556328 4988464.46336245,-8229128.40691213 4988456.8884978,-8229115.39548875 4988459.50357926,-8229115.13749806 4988448.99552612,-8229136.63574414 4988453.35736715,-8229129.08050392 4988453.18115239,-8229136.76790653 4988453.76438188,-8229135.67971702 4988464.64026597,-8229128.09556328 4988464.46336245)))'::geometry,
+    'POLYGON((-8230739.20574778 4989809.20645631,-8230739.20574778 4987363.22155118,-8228293.22084265 4987363.22155118,-8228293.22084265 4989809.20645631,-8230739.20574778 4989809.20645631))'::geometry,
+    4096,
+    16,
+    true
+)), 0) BETWEEN 0 AND 100;

Modified: branches/2.5/regress/mvt_expected
===================================================================
--- branches/2.5/regress/mvt_expected	2019-03-22 11:23:43 UTC (rev 17354)
+++ branches/2.5/regress/mvt_expected	2019-03-22 11:26:09 UTC (rev 17355)
@@ -126,3 +126,4 @@
 #4348ReversedSmall|t
 #4348Reversed2|t
 #4348Point|t
+#4348Crash|t