[PostGIS] #6109: Out-of-bounds heap read in BOX2D_out and BOX2D_expand on 65-byte box2d under ASAN

[PostGIS]

#6109: Out-of-bounds heap read in BOX2D_out and BOX2D_expand on 65-byte box2d
under ASAN
----------------------+---------------------------
  Reporter:  dtighe   |      Owner:  pramsey
      Type:  defect   |     Status:  new
  Priority:  medium   |  Milestone:  PostGIS 3.6.5
 Component:  postgis  |    Version:  3.6.x
Resolution:           |   Keywords:
----------------------+---------------------------
Comment (by Regina Obe <lr@…>):

 In [changeset:"31aec6787f974c94ff5fa0180969d73dd1817e14/git" 31aec67/git]:
 {{{#!CommitTicketReference repository="git"
 revision="31aec6787f974c94ff5fa0180969d73dd1817e14"
 Fix out-of-bounds read in BOX2D_out and BOX2D_expand

 box2d is declared with internallength=65 (postgis.sql.in), which is 7
 bytes short of sizeof(GBOX) (72). Copying the full GBOX struct (72 bytes)
 via
 memcpy in BOX2D_out and BOX2D_expand causes a 7-byte out-of-bounds heap
 read under ASAN. Reference: #6109

 This change fixes this by copying only up to offsetof(GBOX, zmin), which
 contains all
 2D box fields (xmin, xmax, ymin, ymax, flags, SRID) within the 65-byte
 payload.
 This also memzeros the target buffer out as a defensive measure where it
 wasn't
 done previously.

 Add regression test regress/core/box2d.sql (these fail under ASAN today).

 References #6109 for PostGIS 3.7.0
 Closes https://gitea.osgeo.org/postgis/postgis/pulls/628 for PostGIS 3.7.0
 }}}
-- 
Ticket URL: <https://trac.osgeo.org/postgis/ticket/6109#comment:3>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.