[postgis-tickets] r17847 - getSRIDbySRS: Fix crash

[Raul]

Author: algunenano
Date: 2019-10-02 07:23:26 -0700 (Wed, 02 Oct 2019)
New Revision: 17847

Modified:
   branches/2.5/NEWS
   branches/2.5/postgis/lwgeom_export.c
Log:
getSRIDbySRS: Fix crash

- Prevents stack overflow when the srs is long (query + srs > 256 chars).
- Prevents sql injection.

References #4519



Modified: branches/2.5/NEWS
===================================================================
--- branches/2.5/NEWS	2019-10-02 13:45:21 UTC (rev 17846)
+++ branches/2.5/NEWS	2019-10-02 14:23:26 UTC (rev 17847)
@@ -13,6 +13,7 @@
   - #4496, Make ST_Simplify(TRIANGLE) collapse if requested (Raúl Marín)
   - #4506, Remove tolerance in point-in-ring tests (Paul Ramsey)
   - #4338, Fix Census block level data (tabblock table) loading (Regina Obe)
+  - #4519, Fix getSRIDbySRS crash (Raúl Marín)
 
 
 PostGIS 2.5.3

Modified: branches/2.5/postgis/lwgeom_export.c
===================================================================
--- branches/2.5/postgis/lwgeom_export.c	2019-10-02 13:45:21 UTC (rev 17846)
+++ branches/2.5/postgis/lwgeom_export.c	2019-10-02 14:23:26 UTC (rev 17847)
@@ -29,7 +29,9 @@
  */
 
 #include "float.h" /* for DBL_DIG */
+
 #include "postgres.h"
+#include "catalog/pg_type.h" /* for CSTRINGOID */
 #include "executor/spi.h"
 #include "utils/builtins.h"
 
@@ -117,25 +119,25 @@
 */
 int getSRIDbySRS(const char* srs)
 {
-	char query[256];
-	int srid, err;
+	char *query =
+	    "SELECT srid "
+	    "FROM spatial_ref_sys, "
+	    "regexp_matches($1::text, E'([a-z]+):([0-9]+)', 'gi') AS re "
+	    "WHERE re[1] ILIKE auth_name AND int4(re[2]) = auth_srid";
+	Oid argtypes[] = {CSTRINGOID};
+	Datum values[] = {CStringGetDatum(srs)};
+	int32_t srid, err;
 
 	if (!srs) return 0;
 
-	if (SPI_OK_CONNECT != SPI_connect ())
+	if (SPI_OK_CONNECT != SPI_connect())
 	{
 		elog(NOTICE, "getSRIDbySRS: could not connect to SPI manager");
-		SPI_finish();
 		return 0;
 	}
-	sprintf(query,
-		"SELECT srid "
-		"FROM spatial_ref_sys, "
-		"regexp_matches('%s', E'([a-z]+):([0-9]+)', 'gi') AS re "
-		"WHERE re[1] ILIKE auth_name AND int4(re[2]) = auth_srid", srs);
 
-	err = SPI_exec(query, 1);
-	if ( err < 0 )
+	err = SPI_execute_with_args(query, 1, argtypes, values, NULL, true, 1);
+	if (err < 0)
 	{
 		elog(NOTICE, "getSRIDbySRS: error executing query %d", err);
 		SPI_finish();
@@ -145,14 +147,14 @@
 	/* no entry in spatial_ref_sys */
 	if (SPI_processed <= 0)
 	{
-		sprintf(query,
-			"SELECT srid "
-			"FROM spatial_ref_sys, "
-			"regexp_matches('%s', E'urn:ogc:def:crs:([a-z]+):.*:([0-9]+)', 'gi') AS re "
-			"WHERE re[1] ILIKE auth_name AND int4(re[2]) = auth_srid", srs);
+		query =
+		    "SELECT srid "
+		    "FROM spatial_ref_sys, "
+		    "regexp_matches($1::text, E'urn:ogc:def:crs:([a-z]+):.*:([0-9]+)', 'gi') AS re "
+		    "WHERE re[1] ILIKE auth_name AND int4(re[2]) = auth_srid";
 
-		err = SPI_exec(query, 1);
-		if ( err < 0 )
+		err = SPI_execute_with_args(query, 1, argtypes, values, NULL, true, 1);
+		if (err < 0)
 		{
 			elog(NOTICE, "getSRIDbySRS: error executing query %d", err);
 			SPI_finish();
@@ -159,7 +161,8 @@
 			return 0;
 		}
 
-		if (SPI_processed <= 0) {
+		if (SPI_processed <= 0)
+		{
 			SPI_finish();
 			return 0;
 		}
@@ -166,7 +169,6 @@
 	}
 
 	srid = atoi(SPI_getvalue(SPI_tuptable->vals[0], SPI_tuptable->tupdesc, 1));
-
 	SPI_finish();
 
 	return srid;