[SCM] PostGIS branch master updated. 3.7.0beta2-38-ged950a3b0

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, master has been updated
       via  ed950a3b0b2aeda97bfcbb6db62c8be9ad38be0c (commit)
       via  b0cb1d6cc9a2542a7e3159cfbbe1c83c2bef3d6d (commit)
       via  e1976d06de4947ae75028694f84b0cc96f32f3f9 (commit)
      from  4503d6fbce558d54d67bf9eacafc3607bbdf51aa (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ed950a3b0b2aeda97bfcbb6db62c8be9ad38be0c
Merge: 4503d6fbc b0cb1d6cc
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date:   Fri Aug 14 04:14:06 2026 -0700

    Merge pull request 'liblwgeom: validate NURBS vectors before reading' (!721) from Komzpa/postgis:fix/nurbs-validate-bounds-20260810 into master
    
    The GSERIALIZED v2 NURBS validation path computed the total serialized byte count, but dereferenced the weights and knots vectors before checking that the full NURBS payload was actually available. A truncated payload could therefore be read past the declared buffer before the later generic range check rejected it.
    
    This adds an early NURBS payload range check immediately after the overflow-safe size calculation and before deriving the vector pointers passed to `gserialized2_validate_nurbs()`. The existing final generic payload check is left in place for the shared validation path.
    
    The CUnit coverage now includes a short-allocation NURBS-vector regression that copies only the fixed NURBS header from a valid serialized curve. Under ASAN allocation-size validation this exercises the old read-before-bounds ordering; in non-ASAN builds the test is registered but skipped with a pass marker, matching the existing short-allocation coverage style.
    
    Current head: `b0cb1d6cc9a2542a7e3159cfbbe1c83c2bef3d6d`.
    
    Validation:
    
    - `./autogen.sh && ./configure --without-raster --without-topology --without-sfcgal --without-protobuf --disable-spellcheck-tests`
    - `make -C liblwgeom -j32 && make -C liblwgeom/cunit check` (`373` tests, `5826` assertions)
    - `git clang-format --extensions c,h gitea/master --diff`
    - `git diff --check gitea/master...HEAD`
    - scope gate: only `NEWS`, `liblwgeom/gserialized2.c`, and `liblwgeom/cunit/cu_gserialized2.c` changed; generated/build artifact scan passed
    
    Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/721


commit b0cb1d6cc9a2542a7e3159cfbbe1c83c2bef3d6d
Author: Darafei Praliaskouski <me at komzpa.net>
Date:   Mon Aug 10 23:56:56 2026 +0400

    NEWS: mention GSERIALIZED NURBS vector validation

diff --git a/NEWS b/NEWS
index fa225e8b7..d167ad9a0 100644
--- a/NEWS
+++ b/NEWS
@@ -23,6 +23,8 @@ These are only changes since 3.7.0beta2.
           deserializing geometry data (Darafei Praliaskouski)
  - OSSFuzz 544936363, keep GSERIALIZED LWGEOM fuzzer bbox
           comparisons aligned with serialized bbox flags (Darafei Praliaskouski)
+ - Reject truncated GSERIALIZED NURBS vector payloads before validating vector
+          contents (Darafei Praliaskouski)
  - OSSFuzz 6152109301760000, reject overlong encoded polyline coordinate
           varints (Darafei Praliaskouski)
  - OSSFuzz 4743900859006976, reject encoded polyline coordinate deltas

commit e1976d06de4947ae75028694f84b0cc96f32f3f9
Author: Darafei Praliaskouski <me at komzpa.net>
Date:   Mon Aug 10 23:30:12 2026 +0400

    liblwgeom: validate NURBS vectors before reading

diff --git a/liblwgeom/cunit/cu_gserialized2.c b/liblwgeom/cunit/cu_gserialized2.c
index 61cdf5a80..6ee2f877c 100644
--- a/liblwgeom/cunit/cu_gserialized2.c
+++ b/liblwgeom/cunit/cu_gserialized2.c
@@ -620,6 +620,34 @@ test_gserialized2_malformed_polygon_ring_count(void)
 	lwfree(g);
 }
 
+static void
+test_gserialized2_malformed_nurbs_short_vectors(void)
+{
+#if defined(POSTGIS_ASAN_ALLOCATOR_SIZE)
+	LWGEOM *lwgeom = lwgeom_from_wkt("NURBSCURVE(2, (0 0, 1 1, 2 0))", LW_PARSER_CHECK_NONE);
+	GSERIALIZED *full;
+	GSERIALIZED *short_g;
+	size_t short_size;
+
+	CU_ASSERT_PTR_NOT_NULL_FATAL(lwgeom);
+	full = gserialized2_from_lwgeom(lwgeom, NULL);
+	CU_ASSERT_PTR_NOT_NULL_FATAL(full);
+
+	short_size = (size_t)(gserialized2_test_payload_p(full) - (uint8_t *)(void *)full) + 6 * sizeof(uint32_t);
+	short_g = malloc(short_size);
+	CU_ASSERT_PTR_NOT_NULL_FATAL(short_g);
+	memcpy(short_g, full, short_size);
+
+	assert_gserialized2_malformed_rejected(short_g);
+
+	free(short_g);
+	lwfree(full);
+	lwgeom_free(lwgeom);
+#else
+	CU_PASS("short NURBS vector validation requires AddressSanitizer allocation metadata");
+#endif
+}
+
 static void
 assert_gserialized2_malformed_rejected(GSERIALIZED *g)
 {
@@ -735,6 +763,7 @@ void gserialized2_suite_setup(void)
 	PG_ADD_TEST(suite, test_gserialized2_malformed_collection_count);
 	PG_ADD_TEST(suite, test_gserialized2_malformed_nurbs_degree);
 	PG_ADD_TEST(suite, test_gserialized2_malformed_polygon_ring_count);
+	PG_ADD_TEST(suite, test_gserialized2_malformed_nurbs_short_vectors);
 	PG_ADD_TEST(suite, test_gserialized2_malformed_declared_size);
 	PG_ADD_TEST(suite, test_gserialized2_malformed_short_allocation);
 	PG_ADD_TEST(suite, test_gserialized2_wkb_roundtrip_float_rounded_box);
diff --git a/liblwgeom/gserialized2.c b/liblwgeom/gserialized2.c
index d8169979a..f0a6bdd7c 100644
--- a/liblwgeom/gserialized2.c
+++ b/liblwgeom/gserialized2.c
@@ -552,6 +552,11 @@ gserialized2_validate_geometry_buffer(uint8_t *data_ptr, uint8_t *data_end, lwfl
 			lwerror("%s: GSERIALIZED NURBS size overflows", __func__);
 			return LW_FAILURE;
 		}
+		if (!gserialized2_range_available(data_ptr, data_end, consumed))
+		{
+			lwerror("%s: GSERIALIZED NURBS payload exceeds declared size", __func__);
+			return LW_FAILURE;
+		}
 		weights_ptr = data_ptr + 6 * sizeof(uint32_t);
 		knots_ptr = weights_ptr + weight_bytes;
 		if (gserialized2_validate_nurbs(

-----------------------------------------------------------------------

Summary of changes:
 NEWS                              |  2 ++
 liblwgeom/cunit/cu_gserialized2.c | 29 +++++++++++++++++++++++++++++
 liblwgeom/gserialized2.c          |  5 +++++
 3 files changed, 36 insertions(+)


hooks/post-receive
-- 
PostGIS