[SCM] PostGIS branch stable-3.6 updated. 3.6.4-106-g36241ae180
git at osgeo.org
git at osgeo.org
Mon Aug 3 00:29:42 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, stable-3.6 has been updated
via 36241ae1809fd6335c22fbff12785720d05f3997 (commit)
via 8227f9b542e6c3fcd8c05b80e1126df6ae621daa (commit)
from 6fd44ca600201cf916447c8586346e7d05d94335 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 36241ae1809fd6335c22fbff12785720d05f3997
Author: Regina Obe <lr at pcorp.us>
Date: Mon Aug 3 03:29:27 2026 -0400
Add NEWS and credits. Reference #6109 for PostGIS 3.6.5
diff --git a/NEWS b/NEWS
index 26417e01b4..63e6a05a2d 100644
--- a/NEWS
+++ b/NEWS
@@ -57,7 +57,8 @@ PostGIS 3.6.5
(Darafei Praliaskouski)
- GT-564, Avoid ST_MakePolygon failures with NULL hole array entries
(Darafei Praliaskouski)
-
+- #6109, Out-of-bounds heap read in BOX2D_out and BOX2D_expand
+ on 65-byte box2d under ASAN (Dennis Tighe, Google)
PostGIS 3.6.4
2026/06/08
diff --git a/doc/introduction.xml b/doc/introduction.xml
index 983f01f64f..8e2e9f30ef 100644
--- a/doc/introduction.xml
+++ b/doc/introduction.xml
@@ -247,6 +247,7 @@
<member>Christoph Berg</member>
<member>Christoph Moench-Tegeder</member>
<member>Dane Springmeyer</member>
+ <member>Dennis Tighe</member>
<member>Daniel Nylander</member>
<member>Dapeng Wang</member>
<member>Daryl Herzmann</member>
commit 8227f9b542e6c3fcd8c05b80e1126df6ae621daa
Author: Dennis Tighe, Google <dtighe at google.com>
Date: Wed Jul 29 17:49:01 2026 -0700
Fix out-of-bounds read in BOX2D_out and BOX2D_expand
box2d is declared with internallength=65 (postgis.sql.in), which is 7
bytes short of sizeof(GBOX) (72). Copying the full GBOX struct (72 bytes) via
memcpy in BOX2D_out and BOX2D_expand causes a 7-byte out-of-bounds heap
read under ASAN. Reference: #6109
This change fixes this by copying only up to offsetof(GBOX, zmin), which contains all
2D box fields (xmin, xmax, ymin, ymax, flags, SRID) within the 65-byte payload.
This also memzeros the target buffer out as a defensive measure where it wasn't
done previously.
Add regression test regress/core/box2d.sql (these fail under ASAN today).
References #6109 for PostGIS 3.6.5
Closes https://gitea.osgeo.org/postgis/postgis/pulls/628 for PostGIS 3.6.5
diff --git a/postgis/lwgeom_box.c b/postgis/lwgeom_box.c
index 98b39ed955..f53424507a 100644
--- a/postgis/lwgeom_box.c
+++ b/postgis/lwgeom_box.c
@@ -100,9 +100,15 @@ Datum BOX2D_out(PG_FUNCTION_ARGS)
int size = 0;
GBOX *box = (GBOX *)PG_GETARG_POINTER(0);
- /* Avoid unaligned access to the gbox struct */
+ /* Avoid unaligned access to the gbox struct.
+ *
+ * box2d can be 65 bytes, which is 7 bytes short of sizeof(GBOX) (72)
+ * so just copy the required part (xy/min, xy/max) and zero the rest
+ * (matches BOX2d_expand).
+ */
GBOX box_aligned;
- memcpy(&box_aligned, box, sizeof(GBOX));
+ memset(&box_aligned, 0, sizeof(box_aligned));
+ memcpy(&box_aligned, box, offsetof(GBOX, zmin));
size = 4;
size += lwprint_double(box_aligned.xmin, precision, &tmp[size]);
@@ -387,8 +393,10 @@ PG_FUNCTION_INFO_V1(BOX2D_expand);
Datum BOX2D_expand(PG_FUNCTION_ARGS)
{
GBOX *box = (GBOX *)PG_GETARG_POINTER(0);
- GBOX *result = (GBOX *)palloc(sizeof(GBOX));
- memcpy(result, box, sizeof(GBOX));
+ /* box2d is 65 bytes (7 bytes short of sizeof(GBOX)) and is a purely
+ * 2D box; copy only the 2D header */
+ GBOX *result = (GBOX *)palloc0(sizeof(GBOX));
+ memcpy(result, box, offsetof(GBOX, zmin));
if (PG_NARGS() == 2)
{
diff --git a/regress/core/box2d.sql b/regress/core/box2d.sql
new file mode 100644
index 0000000000..746f778603
--- /dev/null
+++ b/regress/core/box2d.sql
@@ -0,0 +1,8 @@
+-- box2d output / expand must not read past a materialised box2d value.
+-- see #6109
+SELECT 'out', ('LINESTRING(0 0,1 1)'::geometry::box2d)::text;
+SELECT 'out_3d', ('LINESTRING Z (0 0 9,2 3 9)'::geometry::box2d)::text;
+SELECT 'roundtrip', 'BOX(1.5 2.5,3.5 4.5)'::box2d::text;
+SELECT 'extent', ST_Extent(g)::text FROM (VALUES ('POINT(0 0)'::geometry),('POINT(5 7)'::geometry)) v(g);
+SELECT 'expand_d', ST_Expand('LINESTRING(0 0,10 10)'::geometry::box2d, 1)::text;
+SELECT 'expand_dxdy',ST_Expand('LINESTRING(0 0,10 10)'::geometry::box2d, 2, 3)::text;
diff --git a/regress/core/box2d_expected b/regress/core/box2d_expected
new file mode 100644
index 0000000000..e6ce8e0b6d
--- /dev/null
+++ b/regress/core/box2d_expected
@@ -0,0 +1,6 @@
+out|BOX(0 0,1 1)
+out_3d|BOX(0 0,2 3)
+roundtrip|BOX(1.5 2.5,3.5 4.5)
+extent|BOX(0 0,5 7)
+expand_d|BOX(-1 -1,11 11)
+expand_dxdy|BOX(-2 -3,12 13)
diff --git a/regress/core/tests.mk.in b/regress/core/tests.mk.in
index a959ad92f3..734209cd5d 100644
--- a/regress/core/tests.mk.in
+++ b/regress/core/tests.mk.in
@@ -32,6 +32,7 @@ TESTS += \
$(top_srcdir)/regress/core/bestsrid \
$(top_srcdir)/regress/core/binary \
$(top_srcdir)/regress/core/boundary \
+ $(top_srcdir)/regress/core/box2d \
$(top_srcdir)/regress/core/chaikin \
$(top_srcdir)/regress/core/filterm \
$(top_srcdir)/regress/core/cluster \
-----------------------------------------------------------------------
Summary of changes:
NEWS | 3 ++-
doc/introduction.xml | 1 +
postgis/lwgeom_box.c | 16 ++++++++++++----
regress/core/box2d.sql | 8 ++++++++
regress/core/box2d_expected | 6 ++++++
regress/core/tests.mk.in | 1 +
6 files changed, 30 insertions(+), 5 deletions(-)
create mode 100644 regress/core/box2d.sql
create mode 100644 regress/core/box2d_expected
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list