[SCM] PostGIS branch master updated. 3.7.0beta2-21-g5de061ff1

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, master has been updated
       via  5de061ff1c8e927e25ae3aa8c6a48d69f2ae093f (commit)
       via  809ca7e307cfc0d81b5adbf0c0a0c806c5367451 (commit)
      from  2b660395d68955fff632ec1774d2f04698edb6d2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5de061ff1c8e927e25ae3aa8c6a48d69f2ae093f
Merge: 2b660395d 809ca7e30
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date:   Tue Aug 11 06:10:37 2026 -0700

    Merge pull request 'fuzzers: compare serialized LWGEOM bboxes by stored flags' (!725) from Komzpa/postgis:fix/ossfuzz-544936363-gserialized-lwgeom into master
    
    The `gserialized_from_lwgeom_fuzzer` bbox oracle was still assuming that the
    parsed input bbox metadata is the exact metadata that `GSERIALIZED` will write
    back out.
    
    Malformed WKB can leave the input geometry flags and input bbox flags out of
    sync. `GSERIALIZED` serializes the bbox according to the geometry flags, so a
    round trip can legitimately return a bbox with different serialized metadata
    while preserving the geometry payload. This updates the fuzzer oracle to build
    the expected bbox using the serialized geometry flags, include the geodetic Z
    ordinates written by `GSERIALIZED`, and avoid treating NaN payload differences
    as a fuzzer crash.
    
    References: https://issues.oss-fuzz.com/issues/544936363
    
    Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/725


commit 809ca7e307cfc0d81b5adbf0c0a0c806c5367451
Author: Darafei Praliaskouski <me at komzpa.net>
Date:   Tue Aug 11 17:05:52 2026 +0400

    fuzzers: compare serialized LWGEOM bboxes by stored flags
    
    The GSERIALIZED-from-LWGEOM fuzzer used the parsed input bbox as the direct oracle for the round-tripped bbox. Malformed WKB can carry bbox flags that do not match the geometry flags; serialization writes the bbox according to the geometry flags, so the round trip can legitimately return different serialized bbox metadata while preserving geometry semantics.
    
    Build the expected bbox with the serialized geometry flags, include the geodetic Z ordinates that GSERIALIZED writes, and treat NaN payload differences as equal for this oracle.
    
    Credit to OSS-Fuzz.
    
    References: https://issues.oss-fuzz.com/issues/544936363

diff --git a/NEWS b/NEWS
index 46206a39f..70eda4519 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ These are only changes since 3.7.0beta2.
           consistent with hostile varlena size headers (Darafei Praliaskouski)
  - OSSFuzz 544800490, reject malformed GSERIALIZED polygon rings before
           deserializing geometry data (Darafei Praliaskouski)
+ - OSSFuzz 544936363, keep GSERIALIZED LWGEOM fuzzer bbox
+          comparisons aligned with serialized bbox flags (Darafei Praliaskouski)
  - OSSFuzz 6152109301760000, reject overlong encoded polyline coordinate
           varints (Darafei Praliaskouski)
 
diff --git a/fuzzers/gserialized_from_lwgeom_fuzzer.cpp b/fuzzers/gserialized_from_lwgeom_fuzzer.cpp
index b6f2445c5..83eb93315 100644
--- a/fuzzers/gserialized_from_lwgeom_fuzzer.cpp
+++ b/fuzzers/gserialized_from_lwgeom_fuzzer.cpp
@@ -16,6 +16,7 @@
 #include <stddef.h>
 #include <stdint.h>
 #include <stdlib.h>
+#include <math.h>
 
 extern "C" {
 #include "geos_stub.h"
@@ -42,6 +43,39 @@ postgis_fuzzer_assert(int condition)
 		abort();
 }
 
+static int
+same_serialized_double(double expected, double actual)
+{
+	if (isnan(expected) && isnan(actual))
+		return LW_TRUE;
+
+	return expected == actual;
+}
+
+static int
+same_serialized_gbox(const GBOX *expected, const GBOX *actual)
+{
+	if (FLAGS_GET_ZM(expected->flags) != FLAGS_GET_ZM(actual->flags))
+		return LW_FALSE;
+
+	if (!same_serialized_double(expected->xmin, actual->xmin) ||
+	    !same_serialized_double(expected->xmax, actual->xmax) ||
+	    !same_serialized_double(expected->ymin, actual->ymin) ||
+	    !same_serialized_double(expected->ymax, actual->ymax))
+		return LW_FALSE;
+
+	if ((FLAGS_GET_Z(expected->flags) || FLAGS_GET_GEODETIC(expected->flags)) &&
+	    (!same_serialized_double(expected->zmin, actual->zmin) ||
+	     !same_serialized_double(expected->zmax, actual->zmax)))
+		return LW_FALSE;
+
+	if (FLAGS_GET_M(expected->flags) && (!same_serialized_double(expected->mmin, actual->mmin) ||
+					     !same_serialized_double(expected->mmax, actual->mmax)))
+		return LW_FALSE;
+
+	return LW_TRUE;
+}
+
 static void
 assert_matching_gbox(const LWGEOM *input, const LWGEOM *roundtrip)
 {
@@ -56,8 +90,14 @@ assert_matching_gbox(const LWGEOM *input, const LWGEOM *roundtrip)
 
 	/* GSERIALIZED stores a float-rounded bbox. */
 	expected = *input->bbox;
+	expected.flags = input->flags;
 	gbox_float_round(&expected);
-	postgis_fuzzer_assert(gbox_same(&expected, roundtrip->bbox));
+	if (FLAGS_GET_GEODETIC(expected.flags) && !FLAGS_GET_Z(expected.flags))
+	{
+		expected.zmin = next_float_down(expected.zmin);
+		expected.zmax = next_float_up(expected.zmax);
+	}
+	postgis_fuzzer_assert(same_serialized_gbox(&expected, roundtrip->bbox));
 }
 
 static void

-----------------------------------------------------------------------

Summary of changes:
 NEWS                                       |  2 ++
 fuzzers/gserialized_from_lwgeom_fuzzer.cpp | 42 +++++++++++++++++++++++++++++-
 2 files changed, 43 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
PostGIS