[SCM] PostGIS branch master updated. 3.7.0beta2-31-g67cd3dece

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, master has been updated
       via  67cd3deceb298c2705db58da8a3e0d6b5a79302e (commit)
       via  8aeaff1f1539246a0fa63851d83949c772de8dff (commit)
      from  321342d9e1b2f88dfeae3d7050539bfacfd27d10 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 67cd3deceb298c2705db58da8a3e0d6b5a79302e
Merge: 321342d9e 8aeaff1f1
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date:   Wed Aug 12 03:41:44 2026 -0700

    Merge pull request 'Guard encoded polyline coordinate accumulation' (!729) from Komzpa/postgis:fix/encoded-polyline-accum-545389411 into master
    
    OSS-Fuzz found that encoded polyline inputs can produce valid int32 deltas whose cumulative latitude or longitude sum overflows `int32_t`.
    
    This keeps the existing varint validation, but routes coordinate accumulation through a checked `int64_t` add and rejects values outside the int32 coordinate range before storing them back. The new CUnit case covers the minimized OSS-Fuzz input shape, while the existing valid, truncated, and overlong-varint cases stay in the same suite.
    
    Validation:
    
    - `./liblwgeom/cunit/cu_tester encoded_polyline_input`
    - `make check-news`
    - `make check-contributor-credits`
    - `git diff --check upstream/master...HEAD`
    - `git diff --cached --check`
    - `encoded_polyline_import_fuzzer` replay of OSSFuzz testcase 4743900859006976, minimized and unminimized, with no UBSAN runtime-error output
    
    Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/729


commit 8aeaff1f1539246a0fa63851d83949c772de8dff
Author: Darafei Praliaskouski <me at komzpa.net>
Date:   Wed Aug 12 14:37:32 2026 +0400

    Guard encoded polyline coordinate accumulation

diff --git a/NEWS b/NEWS
index f5ecc0175..299e6398d 100644
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,8 @@ These are only changes since 3.7.0beta2.
           comparisons aligned with serialized bbox flags (Darafei Praliaskouski)
  - OSSFuzz 6152109301760000, reject overlong encoded polyline coordinate
           varints (Darafei Praliaskouski)
+ - OSSFuzz 4743900859006976, reject encoded polyline coordinate deltas
+          that overflow accumulated int32 coordinates (Darafei Praliaskouski)
 
 
 
diff --git a/liblwgeom/cunit/cu_in_encoded_polyline.c b/liblwgeom/cunit/cu_in_encoded_polyline.c
index 7fcb7841a..9d9329ba8 100644
--- a/liblwgeom/cunit/cu_in_encoded_polyline.c
+++ b/liblwgeom/cunit/cu_in_encoded_polyline.c
@@ -76,6 +76,19 @@ in_encoded_polyline_test_overlong_varint(void)
 	CU_ASSERT_PTR_NULL(lwgeom_from_encoded_polyline("~~~~~~P", 5));
 }
 
+static void
+in_encoded_polyline_test_coordinate_overflow(void)
+{
+	char input[] = {(char)0xff, (char)0xff, (char)0xff, (char)0xff, (char)0xff, '\\', '?',
+			(char)0xff, (char)0xff, (char)0xff, (char)0xff, (char)0xff, '\\', '?',
+			(char)0xff, (char)0xff, (char)0xff, (char)0xff, '\\',       '?',  (char)0xff,
+			(char)0xff, (char)0xff, (char)0xff, (char)0xff, '\\',       '?',  (char)0xff,
+			(char)0xff, (char)0xff, (char)0xff, (char)0xff, '\\',       0};
+
+	/* OSSFuzz 4743900859006976: cumulative deltas must not overflow int32_t. */
+	CU_ASSERT_PTR_NULL(lwgeom_from_encoded_polyline(input, 2));
+}
+
 /*
 ** Used by test harness to register the tests in this file.
 */
@@ -88,4 +101,5 @@ void in_encoded_polyline_suite_setup(void)
 	PG_ADD_TEST(suite, in_encoded_polyline_test_close_points);
 	PG_ADD_TEST(suite, in_encoded_polyline_test_truncated_input);
 	PG_ADD_TEST(suite, in_encoded_polyline_test_overlong_varint);
+	PG_ADD_TEST(suite, in_encoded_polyline_test_coordinate_overflow);
 }
diff --git a/liblwgeom/lwin_encoded_polyline.c b/liblwgeom/lwin_encoded_polyline.c
index ef35d8c0f..9ee22d4da 100644
--- a/liblwgeom/lwin_encoded_polyline.c
+++ b/liblwgeom/lwin_encoded_polyline.c
@@ -76,6 +76,20 @@ encoded_polyline_zigzag_decode(uint32_t value)
 	return (int32_t)((value >> 1) ^ (uint32_t)(-(int32_t)(value & 1)));
 }
 
+static int
+encoded_polyline_add_delta(int32_t *coordinate, int32_t delta)
+{
+	int64_t next = (int64_t)*coordinate + delta;
+	if (next < INT32_MIN || next > INT32_MAX)
+	{
+		lwerror("lwgeom_from_encoded_polyline: coordinate value is too large");
+		return LW_FALSE;
+	}
+
+	*coordinate = next;
+	return LW_TRUE;
+}
+
 LWGEOM*
 lwgeom_from_encoded_polyline(const char *encodedpolyline, int precision)
 {
@@ -100,7 +114,11 @@ lwgeom_from_encoded_polyline(const char *encodedpolyline, int precision)
 	    return NULL;
     }
     int32_t deltaLat = encoded_polyline_zigzag_decode(res);
-    latitude += deltaLat;
+    if (!encoded_polyline_add_delta(&latitude, deltaLat))
+    {
+	    ptarray_free(pa);
+	    return NULL;
+    }
 
     if (!encoded_polyline_read_varint(encodedpolyline, length, &idx, &res))
     {
@@ -108,7 +126,11 @@ lwgeom_from_encoded_polyline(const char *encodedpolyline, int precision)
 	    return NULL;
     }
     int32_t deltaLon = encoded_polyline_zigzag_decode(res);
-    longitude += deltaLon;
+    if (!encoded_polyline_add_delta(&longitude, deltaLon))
+    {
+	    ptarray_free(pa);
+	    return NULL;
+    }
 
     pt.x = longitude/scale;
     pt.y = latitude/scale;

-----------------------------------------------------------------------

Summary of changes:
 NEWS                                     |  2 ++
 liblwgeom/cunit/cu_in_encoded_polyline.c | 14 ++++++++++++++
 liblwgeom/lwin_encoded_polyline.c        | 26 ++++++++++++++++++++++++--
 3 files changed, 40 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
PostGIS