[SCM] PostGIS branch master updated. 3.7.0beta1-188-gc726cfb93c
git at osgeo.org
git at osgeo.org
Sun Aug 2 22:40:14 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, master has been updated
via c726cfb93c31609f076ebc33bed2cd976922de51 (commit)
via 8c7a156de49610d39bb7cde310e2ea998f8f7913 (commit)
via 31aec6787f974c94ff5fa0180969d73dd1817e14 (commit)
from 66a5f3d56d091911ff502d207082c0792d3a6931 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit c726cfb93c31609f076ebc33bed2cd976922de51
Author: Regina Obe <lr at pcorp.us>
Date: Mon Aug 3 01:39:57 2026 -0400
Change to beta2 since too many changes for an RC
diff --git a/NEWS b/NEWS
index 1b3a9e87da..65e6328bc5 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-PostGIS 3.7.0rc1
+PostGIS 3.7.0beta2
2026/xx/xx
This version requires GEOS 3.10+, PostgreSQL 14-19beta2, Proj 6.1+, libgmp.
To take advantage of all features postgis extension features, GEOS 3.15+ is needed.
commit 8c7a156de49610d39bb7cde310e2ea998f8f7913
Author: Regina Obe <lr at pcorp.us>
Date: Mon Aug 3 01:38:13 2026 -0400
Add Dennis Tighe to credits for https://trac.osgeo.org/postgis/ticket/6109
For PostGIS 3.7.0
diff --git a/.mailmap b/.mailmap
index d72621b923..4508bcf05b 100644
--- a/.mailmap
+++ b/.mailmap
@@ -33,7 +33,7 @@ Darafei Praliaskouski <me at komzpa.net> <komzpa at gojuno.com>
Darafei Praliaskouski <me at komzpa.net> Darafei <komzpa at gmail.com>
Dave Blasby <dblasby at gmail.com> David Blasby <dblasby at gmail.com>
-
+Dennis Tighe <dtighe at google.com>
Devrim Gündüz <devrim at gunduz.org> Devrim GÜNDÜZ <devrim at gunduz.org>
Edouard Choinière <echoix at users.noreply.weblate.osgeo.org> Edouard Choiniere <echoix at users.noreply.weblate.osgeo.org>
diff --git a/NEWS b/NEWS
index d663d01851..1b3a9e87da 100644
--- a/NEWS
+++ b/NEWS
@@ -37,7 +37,9 @@ These are only changes since 3.7.0beta1.
geometry data (Darafei Praliaskouski)
- GT-564, Avoid ST_MakePolygon failures with NULL hole array entries
(Darafei Praliaskouski)
- - #6110, regression in speed with geometry_columns
+ - #6109, Out-of-bounds heap read in BOX2D_out and BOX2D_expand
+ on 65-byte box2d under ASAN (Dennis Tighe, Google)
+ - #6110, regression in speed with geometry_columns (Regina Obe)
* Enhancements *
diff --git a/doc/credits.xml b/doc/credits.xml
index 8f3517223d..cdb0e7be25 100644
--- a/doc/credits.xml
+++ b/doc/credits.xml
@@ -305,6 +305,7 @@
<member>David Garnier</member>
<member>David Skea</member>
<member>David Techer</member>
+ <member>Dennis Tighe</member>
<member>Denys Kovshun</member>
<member>Devrim Gündüz</member>
<member>Dian M Fay</member>
commit 31aec6787f974c94ff5fa0180969d73dd1817e14
Author: Dennis Tighe <dtighe at google.com>
Date: Wed Jul 29 17:49:01 2026 -0700
Fix out-of-bounds read in BOX2D_out and BOX2D_expand
box2d is declared with internallength=65 (postgis.sql.in), which is 7
bytes short of sizeof(GBOX) (72). Copying the full GBOX struct (72 bytes) via
memcpy in BOX2D_out and BOX2D_expand causes a 7-byte out-of-bounds heap
read under ASAN. Reference: #6109
This change fixes this by copying only up to offsetof(GBOX, zmin), which contains all
2D box fields (xmin, xmax, ymin, ymax, flags, SRID) within the 65-byte payload.
This also memzeros the target buffer out as a defensive measure where it wasn't
done previously.
Add regression test regress/core/box2d.sql (these fail under ASAN today).
References #6109 for PostGIS 3.7.0
Closes https://gitea.osgeo.org/postgis/postgis/pulls/628 for PostGIS 3.7.0
diff --git a/postgis/lwgeom_box.c b/postgis/lwgeom_box.c
index 98b39ed955..f53424507a 100644
--- a/postgis/lwgeom_box.c
+++ b/postgis/lwgeom_box.c
@@ -100,9 +100,15 @@ Datum BOX2D_out(PG_FUNCTION_ARGS)
int size = 0;
GBOX *box = (GBOX *)PG_GETARG_POINTER(0);
- /* Avoid unaligned access to the gbox struct */
+ /* Avoid unaligned access to the gbox struct.
+ *
+ * box2d can be 65 bytes, which is 7 bytes short of sizeof(GBOX) (72)
+ * so just copy the required part (xy/min, xy/max) and zero the rest
+ * (matches BOX2d_expand).
+ */
GBOX box_aligned;
- memcpy(&box_aligned, box, sizeof(GBOX));
+ memset(&box_aligned, 0, sizeof(box_aligned));
+ memcpy(&box_aligned, box, offsetof(GBOX, zmin));
size = 4;
size += lwprint_double(box_aligned.xmin, precision, &tmp[size]);
@@ -387,8 +393,10 @@ PG_FUNCTION_INFO_V1(BOX2D_expand);
Datum BOX2D_expand(PG_FUNCTION_ARGS)
{
GBOX *box = (GBOX *)PG_GETARG_POINTER(0);
- GBOX *result = (GBOX *)palloc(sizeof(GBOX));
- memcpy(result, box, sizeof(GBOX));
+ /* box2d is 65 bytes (7 bytes short of sizeof(GBOX)) and is a purely
+ * 2D box; copy only the 2D header */
+ GBOX *result = (GBOX *)palloc0(sizeof(GBOX));
+ memcpy(result, box, offsetof(GBOX, zmin));
if (PG_NARGS() == 2)
{
diff --git a/regress/core/box2d.sql b/regress/core/box2d.sql
new file mode 100644
index 0000000000..746f778603
--- /dev/null
+++ b/regress/core/box2d.sql
@@ -0,0 +1,8 @@
+-- box2d output / expand must not read past a materialised box2d value.
+-- see #6109
+SELECT 'out', ('LINESTRING(0 0,1 1)'::geometry::box2d)::text;
+SELECT 'out_3d', ('LINESTRING Z (0 0 9,2 3 9)'::geometry::box2d)::text;
+SELECT 'roundtrip', 'BOX(1.5 2.5,3.5 4.5)'::box2d::text;
+SELECT 'extent', ST_Extent(g)::text FROM (VALUES ('POINT(0 0)'::geometry),('POINT(5 7)'::geometry)) v(g);
+SELECT 'expand_d', ST_Expand('LINESTRING(0 0,10 10)'::geometry::box2d, 1)::text;
+SELECT 'expand_dxdy',ST_Expand('LINESTRING(0 0,10 10)'::geometry::box2d, 2, 3)::text;
diff --git a/regress/core/box2d_expected b/regress/core/box2d_expected
new file mode 100644
index 0000000000..e6ce8e0b6d
--- /dev/null
+++ b/regress/core/box2d_expected
@@ -0,0 +1,6 @@
+out|BOX(0 0,1 1)
+out_3d|BOX(0 0,2 3)
+roundtrip|BOX(1.5 2.5,3.5 4.5)
+extent|BOX(0 0,5 7)
+expand_d|BOX(-1 -1,11 11)
+expand_dxdy|BOX(-2 -3,12 13)
diff --git a/regress/core/tests.mk.in b/regress/core/tests.mk.in
index 1b14fbeebc..784c507130 100644
--- a/regress/core/tests.mk.in
+++ b/regress/core/tests.mk.in
@@ -33,6 +33,7 @@ TESTS += \
$(top_srcdir)/regress/core/bestsrid \
$(top_srcdir)/regress/core/binary \
$(top_srcdir)/regress/core/boundary \
+ $(top_srcdir)/regress/core/box2d \
$(top_srcdir)/regress/core/catmullrom \
$(top_srcdir)/regress/core/chaikin \
$(top_srcdir)/regress/core/clean \
-----------------------------------------------------------------------
Summary of changes:
.mailmap | 2 +-
NEWS | 6 ++++--
doc/credits.xml | 1 +
postgis/lwgeom_box.c | 16 ++++++++++++----
regress/core/box2d.sql | 8 ++++++++
regress/core/box2d_expected | 6 ++++++
regress/core/tests.mk.in | 1 +
7 files changed, 33 insertions(+), 7 deletions(-)
create mode 100644 regress/core/box2d.sql
create mode 100644 regress/core/box2d_expected
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list