[SCM] PostGIS branch master updated. 3.7.0beta2-35-g4503d6fbc

Fri Aug 14 01:32:55 PDT 2026

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, master has been updated
       via  4503d6fbce558d54d67bf9eacafc3607bbdf51aa (commit)
       via  76ee00687556a247f6e7deb74d43d619447089ff (commit)
      from  4e26c6f769934a1c27d86cb7ae2ca9cc7879d83a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4503d6fbce558d54d67bf9eacafc3607bbdf51aa
Merge: 4e26c6f76 76ee00687
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date:   Fri Aug 14 01:32:53 2026 -0700

    Merge pull request 'Fix SRID prefix scan in geometry input' (!732) from Komzpa/postgis:fix/geometry-in-srid-prefix-oob-20260813 into master
    
    This fixes the `LWGEOM_in` SRID-prefix scan for malformed geometry input that starts with `SRID=` but does not contain the expected `;` separator.
    
    The previous loop searched only for `;`, so `SRID=1` could scan past the end of the PostgreSQL cstring before falling through to the normal parser. The fix stops the scan at the NUL terminator and only checks the next byte when a semicolon was actually found.
    
    The regression coverage keeps the existing valid `SRID=...;POINT(...)` path as a control and adds the no-semicolon malformed input path, which now reaches a clean parse error instead of reading out of bounds.
    
    Patch by Dennis Tighe, Google.
    
    Validation:
    - `make -j$(nproc)`
    - `sudo make install`
    - `make -C regress check RUNTESTFLAGS="--extension" TESTS="$(pwd)/regress/core/wkt"` on PostgreSQL 18.4, loading `3.7.0beta2-34-g76ee00687`, with `Failed: 0` for both create-extension and upgrade passes
    - `git diff --check upstream/master...HEAD`
    - `git clang-format --diff upstream/master -- postgis/lwgeom_inout.c`
    - `make check-contributor-credits`
    
    Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/732


commit 76ee00687556a247f6e7deb74d43d619447089ff
Author: Darafei Praliaskouski <me at komzpa.net>
Date:   Thu Aug 13 19:07:51 2026 +0400

    Fix SRID prefix scan in geometry input
    
    Patch by Dennis Tighe, Google.

diff --git a/NEWS b/NEWS
index 08ba5397d..fa225e8b7 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,9 @@ These are only changes since 3.7.0beta2.
 
 * Bug Fixes *
 
+ - Fix geometry input parsing to stop malformed SRID prefixes before the
+          end of the input string
+          (Dennis Tighe, Google)
  - OSSFuzz 545658571, compare GSERIALIZED bytea fuzzer SRIDs after
           normalizing out-of-range values (Darafei Praliaskouski)
  - OSSFuzz 5607611131822080, keep GSERIALIZED bytea fuzzer allocations
diff --git a/postgis/lwgeom_inout.c b/postgis/lwgeom_inout.c
index 7127e326d..8b21f5588 100644
--- a/postgis/lwgeom_inout.c
+++ b/postgis/lwgeom_inout.c
@@ -107,13 +107,15 @@ Datum LWGEOM_in(PG_FUNCTION_ARGS)
 	/* Starts with "SRID=" */
 	if( strncasecmp(str,"SRID=",5) == 0 )
 	{
-		/* Roll forward to semi-colon */
+		/* Roll forward to semi-colon, stopping at the NUL terminator so we
+		 * never scan past the end of the input cstring */
 		char *tmp = str;
-		while ( tmp && *tmp != ';' )
+		while (*tmp != '\0' && *tmp != ';')
 			tmp++;
 
-		/* Check next character to see if we have WKB  */
-		if ( tmp && *(tmp+1) == '0' )
+		/* Check next character to see if we have WKB (only if we actually
+		 * found a semi-colon; otherwise *(tmp+1) would read past the NUL) */
+		if (*tmp == ';' && *(tmp + 1) == '0')
 		{
 			/* Null terminate the SRID= string */
 			*tmp = '\0';
diff --git a/regress/core/wkt.sql b/regress/core/wkt.sql
index 0d68a4348..f13edb424 100644
--- a/regress/core/wkt.sql
+++ b/regress/core/wkt.sql
@@ -659,3 +659,8 @@ SELECT g,
 'TIN ZM ( ((0 0 0 0, 0 0 1 0, 0 1 0 4, 0 0 0 0)), ((0 0 0 1, 0 1 0 2, 1 1 0 3, 0 0 0 1)) )'
 ::text as g ) as foo;
 
+-- EWKT "SRID=" prefix: a valid prefix parses; a prefix with no ';' separator
+-- must stop at the NUL terminator (not scan past the end of the input) and
+-- fall through to the WKT parser, giving a clean parse error
+SELECT 'srid_prefix_ok', ST_AsEWKT(g::geometry) FROM (SELECT 'SRID=4326;POINT(1 2)'::text AS g) x;
+SELECT 'srid_prefix_no_semicolon', ST_AsEWKT(g::geometry) FROM (SELECT 'SRID=1'::text AS g) x;
diff --git a/regress/core/wkt_expected b/regress/core/wkt_expected
index 93f662d32..452e66d0b 100644
--- a/regress/core/wkt_expected
+++ b/regress/core/wkt_expected
@@ -103,3 +103,5 @@ TIN ( ((0 0, 0 0, 0 1, 0 0)), ((0 0, 0 1, 1 1, 0 0)) )|TIN(((0 0,0 0,0 1,0 0)),(
 TIN Z ( ((0 0 0, 0 0 1, 0 1 0, 0 0 0)), ((0 0 0, 0 1 0, 1 1 0, 0 0 0)) )|TIN Z (((0 0 0,0 0 1,0 1 0,0 0 0)),((0 0 0,0 1 0,1 1 0,0 0 0)))|t
 TIN M ( ((0 0 0, 0 0 1, 0 1 0, 0 0 0)), ((0 0 0, 0 1 0, 1 1 0, 0 0 0)) )|TIN M (((0 0 0,0 0 1,0 1 0,0 0 0)),((0 0 0,0 1 0,1 1 0,0 0 0)))|t
 TIN ZM ( ((0 0 0 0, 0 0 1 0, 0 1 0 4, 0 0 0 0)), ((0 0 0 1, 0 1 0 2, 1 1 0 3, 0 0 0 1)) )|TIN ZM (((0 0 0 0,0 0 1 0,0 1 0 4,0 0 0 0)),((0 0 0 1,0 1 0 2,1 1 0 3,0 0 0 1)))|t
+srid_prefix_ok|SRID=4326;POINT(1 2)
+ERROR:  parse error - invalid geometry

-----------------------------------------------------------------------

Summary of changes:
 NEWS                      |  3 +++
 postgis/lwgeom_inout.c    | 10 ++++++----
 regress/core/wkt.sql      |  5 +++++
 regress/core/wkt_expected |  2 ++
 4 files changed, 16 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
PostGIS
