[SCM] PostGIS branch master updated. 3.7.0beta2-33-g4e26c6f76

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, master has been updated
       via  4e26c6f769934a1c27d86cb7ae2ca9cc7879d83a (commit)
       via  11b2025818f3249d08c1cf4b9b13c7b0a5fce43c (commit)
      from  67cd3deceb298c2705db58da8a3e0d6b5a79302e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4e26c6f769934a1c27d86cb7ae2ca9cc7879d83a
Merge: 67cd3dece 11b202581
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date:   Wed Aug 12 20:58:39 2026 -0700

    Merge pull request 'Fuzzers: normalize GSERIALIZED bytea SRIDs' (!731) from Komzpa/postgis:fix/ossfuzz-gserialized-roundtrip-545658571 into master
    
    OSS-Fuzz issue 545658571 found that `gserialized_from_bytea_fuzzer` could abort while checking a GSERIALIZED -> EWKB bytea -> LWGEOM round trip.
    
    The minimized input carries a raw GSERIALIZED SRID of `0x202020`, outside PostGIS' valid SRID range. Normal serialization paths clamp that value to the WKB-visible SRID `999483`, so the fuzzer oracle was comparing hostile GSERIALIZED-only metadata rather than the semantic value preserved by the bytea round trip.
    
    This updates the fuzzer to compare SRIDs after `clamp_srid()` and to apply the same normalized SRID before the final semantic geometry comparison. It also adds a NEWS entry for the OSS-Fuzz issue.
    
    Validation:
    - `make -j32`
    - `make -C fuzzers dummyfuzzers FUZZER_OUT=/home/kom/proj/ai_pr/postgis-ossfuzz-545658571/fuzzout-fixed -j32`
    - `ASAN_OPTIONS=exitcode=77 fuzzout-fixed/gserialized_from_bytea_fuzzer /home/kom/downloads/clusterfuzz-testcase-minimized-gserialized_from_bytea_fuzzer-6419041586315264`
    - `ASAN_OPTIONS=exitcode=77 fuzzout-fixed/gserialized_from_bytea_fuzzer /home/kom/downloads/clusterfuzz-testcase-gserialized_from_bytea_fuzzer-6419041586315264`
    - `make -C fuzzers check-corpus FUZZER_OUT=/home/kom/proj/ai_pr/postgis-ossfuzz-545658571/fuzzout-fixed`
    - `git clang-format --diff upstream/master -- fuzzers/gserialized_from_bytea_fuzzer.cpp`
    - `git diff --check -- fuzzers/gserialized_from_bytea_fuzzer.cpp NEWS`
    - `make check-contributor-credits`
    
    Credit to OSS-Fuzz.
    
    Closes https://issues.oss-fuzz.com/issues/545658571
    
    Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/731


commit 11b2025818f3249d08c1cf4b9b13c7b0a5fce43c
Author: Darafei Praliaskouski <me at komzpa.net>
Date:   Thu Aug 13 07:31:48 2026 +0400

    fuzzers: normalize GSERIALIZED bytea SRIDs

diff --git a/NEWS b/NEWS
index 299e6398d..08ba5397d 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,8 @@ These are only changes since 3.7.0beta2.
 
 * Bug Fixes *
 
+ - OSSFuzz 545658571, compare GSERIALIZED bytea fuzzer SRIDs after
+          normalizing out-of-range values (Darafei Praliaskouski)
  - OSSFuzz 5607611131822080, keep GSERIALIZED bytea fuzzer allocations
           consistent with hostile varlena size headers (Darafei Praliaskouski)
  - #6111, Skip NEWS unit tests outside Git worktrees, fixing source
diff --git a/fuzzers/gserialized_from_bytea_fuzzer.cpp b/fuzzers/gserialized_from_bytea_fuzzer.cpp
index a62fb1c71..f98f6951c 100644
--- a/fuzzers/gserialized_from_bytea_fuzzer.cpp
+++ b/fuzzers/gserialized_from_bytea_fuzzer.cpp
@@ -70,17 +70,19 @@ assert_gserialized_bytea_roundtrip(LWGEOM *lwgeom)
 	postgis_fuzzer_assert(first_size == LWSIZE_GET(first->size));
 	postgis_fuzzer_assert(second_size == LWSIZE_GET(second->size));
 	postgis_fuzzer_assert(lwgeom->type == from_bytea->type);
-	postgis_fuzzer_assert(lwgeom->srid == from_bytea->srid);
+	postgis_fuzzer_assert(clamp_srid(lwgeom->srid) == from_bytea->srid);
 	postgis_fuzzer_assert(FLAGS_GET_Z(lwgeom->flags) == FLAGS_GET_Z(from_bytea->flags));
 	postgis_fuzzer_assert(FLAGS_GET_M(lwgeom->flags) == FLAGS_GET_M(from_bytea->flags));
 	postgis_fuzzer_assert(FLAGS_GET_GEODETIC(lwgeom->flags) == FLAGS_GET_GEODETIC(from_bytea->flags));
 
-	/* WKB bytea does not preserve GSERIALIZED bounding boxes. Arbitrary
-	 * GSERIALIZED input can carry a bbox that is not byte-for-byte reproduced
-	 * after geometry->bytea->geometry, so compare the semantic geometry.
+	/* WKB bytea does not preserve GSERIALIZED-only metadata. Arbitrary
+	 * GSERIALIZED input can carry a bbox or out-of-range SRID that is
+	 * normalized after geometry->bytea->geometry, so compare the semantic
+	 * geometry after applying the same normalization.
 	 */
 	lwgeom_drop_bbox(lwgeom);
 	lwgeom_drop_bbox(from_bytea);
+	lwgeom_set_srid(lwgeom, from_bytea->srid);
 	postgis_fuzzer_assert(lwgeom_same(lwgeom, from_bytea));
 
 	lwgeom_free(from_bytea);

-----------------------------------------------------------------------

Summary of changes:
 NEWS                                      |  2 ++
 fuzzers/gserialized_from_bytea_fuzzer.cpp | 10 ++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
PostGIS