[postgis-tickets] r17846 - getSRIDbySRS: Fix crash

[Raul]

Author: algunenano
Date: 2019-10-02 06:45:21 -0700 (Wed, 02 Oct 2019)
New Revision: 17846

Modified:
   trunk/NEWS
   trunk/postgis/lwgeom_export.c
Log:
getSRIDbySRS: Fix crash

- Prevents stack overflow when the srs is long (query + srs > 256 chars).
- Prevents sql injection.

References #4519
Closes https://github.com/postgis/postgis/pull/487



Modified: trunk/NEWS
===================================================================
--- trunk/NEWS	2019-10-01 17:29:34 UTC (rev 17845)
+++ trunk/NEWS	2019-10-02 13:45:21 UTC (rev 17846)
@@ -1,8 +1,16 @@
 PostGIS 3.0.0beta2
 2019/10/xx
 
+For full changes and enhancements, refer to PostGIS 3.0.0.
+This version requires PostgreSQL 9.5+-12 and GEOS >= 3.6+
+Additional features enabled if you are running Proj6+ and PostgreSQL 12
+Additional performance enhancements if running GEOS 3.8+
 
+* Major highlights *
+  - #4519, Fix getSRIDbySRS crash (Raúl Marín)
 
+
+
 PostGIS 3.0.0beta1
 2019/09/28
 For full changes and enhancements, refer to PostGIS 3.0.0.

Modified: trunk/postgis/lwgeom_export.c
===================================================================
--- trunk/postgis/lwgeom_export.c	2019-10-01 17:29:34 UTC (rev 17845)
+++ trunk/postgis/lwgeom_export.c	2019-10-02 13:45:21 UTC (rev 17846)
@@ -29,7 +29,9 @@
  */
 
 #include "float.h" /* for DBL_DIG */
+
 #include "postgres.h"
+#include "catalog/pg_type.h" /* for CSTRINGOID */
 #include "executor/spi.h"
 #include "utils/builtins.h"
 
@@ -125,25 +127,25 @@
 */
 int getSRIDbySRS(const char* srs)
 {
-	char query[256];
+	char *query =
+	    "SELECT srid "
+	    "FROM spatial_ref_sys, "
+	    "regexp_matches($1::text, E'([a-z]+):([0-9]+)', 'gi') AS re "
+	    "WHERE re[1] ILIKE auth_name AND int4(re[2]) = auth_srid";
+	Oid argtypes[] = {CSTRINGOID};
+	Datum values[] = {CStringGetDatum(srs)};
 	int32_t srid, err;
 
 	if (!srs) return 0;
 
-	if (SPI_OK_CONNECT != SPI_connect ())
+	if (SPI_OK_CONNECT != SPI_connect())
 	{
 		elog(NOTICE, "getSRIDbySRS: could not connect to SPI manager");
-		SPI_finish();
 		return 0;
 	}
-	sprintf(query,
-		"SELECT srid "
-		"FROM spatial_ref_sys, "
-		"regexp_matches('%s', E'([a-z]+):([0-9]+)', 'gi') AS re "
-		"WHERE re[1] ILIKE auth_name AND int4(re[2]) = auth_srid", srs);
 
-	err = SPI_exec(query, 1);
-	if ( err < 0 )
+	err = SPI_execute_with_args(query, 1, argtypes, values, NULL, true, 1);
+	if (err < 0)
 	{
 		elog(NOTICE, "getSRIDbySRS: error executing query %d", err);
 		SPI_finish();
@@ -153,14 +155,14 @@
 	/* no entry in spatial_ref_sys */
 	if (SPI_processed <= 0)
 	{
-		sprintf(query,
-			"SELECT srid "
-			"FROM spatial_ref_sys, "
-			"regexp_matches('%s', E'urn:ogc:def:crs:([a-z]+):.*:([0-9]+)', 'gi') AS re "
-			"WHERE re[1] ILIKE auth_name AND int4(re[2]) = auth_srid", srs);
+		query =
+		    "SELECT srid "
+		    "FROM spatial_ref_sys, "
+		    "regexp_matches($1::text, E'urn:ogc:def:crs:([a-z]+):.*:([0-9]+)', 'gi') AS re "
+		    "WHERE re[1] ILIKE auth_name AND int4(re[2]) = auth_srid";
 
-		err = SPI_exec(query, 1);
-		if ( err < 0 )
+		err = SPI_execute_with_args(query, 1, argtypes, values, NULL, true, 1);
+		if (err < 0)
 		{
 			elog(NOTICE, "getSRIDbySRS: error executing query %d", err);
 			SPI_finish();
@@ -167,7 +169,8 @@
 			return 0;
 		}
 
-		if (SPI_processed <= 0) {
+		if (SPI_processed <= 0)
+		{
 			SPI_finish();
 			return 0;
 		}
@@ -174,7 +177,6 @@
 	}
 
 	srid = atoi(SPI_getvalue(SPI_tuptable->vals[0], SPI_tuptable->tupdesc, 1));
-
 	SPI_finish();
 
 	return srid;