[SCM] PostGIS branch master updated. 3.7.0beta2-112-gb2d575041
git at osgeo.org
git at osgeo.org
Sat Aug 22 10:55:05 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, master has been updated
via b2d575041cbbb33402ed52c90284e93e7c649248 (commit)
via 6280c826774bf96ca9e853cb6c17fc84c0f10960 (commit)
via f614226bff6a216e123a9d86a5bceadaa50b90c2 (commit)
via 92a0d53e4c3f5898ee34236fde4a641b7f1a7f6f (commit)
via 1c8473cb5658c51202041b3383429bdacf6d2e8a (commit)
via 19b9369827713532e8359b3ec3b62c5d7b9f7cd5 (commit)
from e60f6e26ef94463ff53593a65bec2883ec9073ab (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit b2d575041cbbb33402ed52c90284e93e7c649248
Merge: e60f6e26e 6280c8267
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date: Sat Aug 22 10:55:03 2026 -0700
Merge pull request 'Guard NULL dereferences in lwgeom_wrapx and raster cleanup' (!765) from Komzpa/postgis:combine/github-1172-1174-news-20260822 into master
This combines the three single-commit GitHub mirror pull requests from Maksim Korotkov and adds a top NEWS entry for the release notes.
Closes https://github.com/postgis/postgis/pull/1172
Closes https://github.com/postgis/postgis/pull/1173
Closes https://github.com/postgis/postgis/pull/1174
Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/765
commit 6280c826774bf96ca9e853cb6c17fc84c0f10960
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Sat Aug 22 21:49:28 2026 +0400
Add NEWS for NULL dereference fixes
diff --git a/NEWS b/NEWS
index 63e6b127a..05fa84500 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,8 @@ These are only changes since 3.7.0beta2.
* Bug Fixes *
+ - GH-1172, GH-1173, GH-1174, guard lwgeom_wrapx and raster OOM cleanup paths
+ against NULL dereferences (Maksim Korotkov, Postgres Pro)
- Codex security scan, guard the recursive NURBSCURVE bounding box
against non-finite control points to stop a backend CPU denial
of service reachable from WKT input (Darafei Praliaskouski)
commit f614226bff6a216e123a9d86a5bceadaa50b90c2
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Sat Aug 22 21:49:28 2026 +0400
Apply clang-format to NULL dereference fixes
diff --git a/liblwgeom/lwgeom_wrapx.c b/liblwgeom/lwgeom_wrapx.c
index 94a651685..9ebeda8dc 100644
--- a/liblwgeom/lwgeom_wrapx.c
+++ b/liblwgeom/lwgeom_wrapx.c
@@ -193,7 +193,8 @@ lwgeom_wrapx(const LWGEOM* lwgeom_in, double cutx, double amount)
{
const LWPOINT *pt = lwgeom_as_lwpoint(lwgeom_clone_deep(lwgeom_in));
POINT4D pt4d;
- if ( ! pt ) return NULL;
+ if (!pt)
+ return NULL;
getPoint4d_p(pt->point, 0, &pt4d);
LWDEBUGF(2, "POINT X is %g, cutx:%g, amount:%g", pt4d.x, cutx, amount);
diff --git a/raster/rt_core/rt_mapalgebra.c b/raster/rt_core/rt_mapalgebra.c
index 47fba81e0..b617c5788 100644
--- a/raster/rt_core/rt_mapalgebra.c
+++ b/raster/rt_core/rt_mapalgebra.c
@@ -1504,7 +1504,8 @@ _rti_colormap_arg_destroy(_rti_colormap_arg arg) {
rt_raster_destroy(arg->raster);
}
- if (arg->expr != NULL) {
+ if (arg->expr != NULL)
+ {
for (i = 0; i < arg->nexpr; i++) {
if (arg->expr[i] == NULL)
break;
commit 92a0d53e4c3f5898ee34236fde4a641b7f1a7f6f
Author: Maksim Korotkov <m.korotkov at postgrespro.ru>
Date: Sat Aug 22 20:02:22 2026 +0300
Prevent NULL deref when shrinking raster file list fails
When rtrealloc fails on the in-memory raster file list, config->rt_file
becomes NULL while config->rt_file_count is left non-zero. The
subsequent rtdealloc_config() then iterates count..0 dereferencing
config->rt_file[i] on a NULL array, crashing in the OOM cleanup path.
Reset rt_file_count to 0 before running the error cleanup so the
partial state is not dereferenced. Applies to both the append path
(grow) and the schema.table-parse path (shrink).
Fixes: 8b8ce38f5dd2b30f8d8bac3a09bc60213688f48d
Signed-off-by: Maksim Korotkov <m.korotkov at postgrespro.ru>
diff --git a/raster/loader/raster2pgsql.c b/raster/loader/raster2pgsql.c
index e0575a592..9ed52e674 100644
--- a/raster/loader/raster2pgsql.c
+++ b/raster/loader/raster2pgsql.c
@@ -2943,6 +2943,7 @@ main(int argc, char **argv) {
config->rt_file_count++;
config->rt_file = (char **) rtrealloc(config->rt_file, sizeof(char *) * config->rt_file_count);
if (config->rt_file == NULL) {
+ config->rt_file_count = 0;
rterror(_("Could not allocate memory for storing raster files"));
rtdealloc_config(config);
exit(1);
@@ -3027,6 +3028,7 @@ main(int argc, char **argv) {
rtdealloc(config->rt_file[--(config->rt_file_count)]);
config->rt_file = (char **) rtrealloc(config->rt_file, sizeof(char *) * config->rt_file_count);
if (config->rt_file == NULL) {
+ config->rt_file_count = 0;
rterror(_("Could not reallocate the memory holding raster names"));
rtdealloc_config(config);
exit(1);
commit 1c8473cb5658c51202041b3383429bdacf6d2e8a
Author: Maksim Korotkov <m.korotkov at postgrespro.ru>
Date: Sat Aug 22 19:20:48 2026 +0300
Fix NULL deref in raster colormap arg cleanup
__rti_colormap_arg_destroy dereferenced arg->expr[i] without first
checking that the array itself was allocated. When rtalloc fails
(arg->expr == NULL) the destroy path reads from a NULL array and
crashes. Guard the loop on arg->expr != NULL and stop at the first
NULL element, which also avoids freeing uninitialized entries when
a partial allocation (rtalloc of individual expressions) fails.
Fixes: 46a76d3b39bb36c2b896e2a67dc88dac13be1fce
Found by PostgresPro.
Signed-off-by: Maksim Korotkov <m.korotkov at postgrespro.ru>
diff --git a/raster/rt_core/rt_mapalgebra.c b/raster/rt_core/rt_mapalgebra.c
index 82201de2d..47fba81e0 100644
--- a/raster/rt_core/rt_mapalgebra.c
+++ b/raster/rt_core/rt_mapalgebra.c
@@ -1504,10 +1504,11 @@ _rti_colormap_arg_destroy(_rti_colormap_arg arg) {
rt_raster_destroy(arg->raster);
}
- if (arg->nexpr) {
+ if (arg->expr != NULL) {
for (i = 0; i < arg->nexpr; i++) {
- if (arg->expr[i] != NULL)
- rtdealloc(arg->expr[i]);
+ if (arg->expr[i] == NULL)
+ break;
+ rtdealloc(arg->expr[i]);
}
rtdealloc(arg->expr);
}
commit 19b9369827713532e8359b3ec3b62c5d7b9f7cd5
Author: Maksim Korotkov <m.korotkov at postgrespro.ru>
Date: Sat Aug 22 11:03:56 2026 +0300
Guard against NULL in lwgeom_wrapx point clone
lwgeom_clone_deep can return NULL when the underlying allocator
(default_allocator -> malloc) fails, which propagates through
lwgeom_as_lwpoint and is dereferenced at pt->point. Add a NULL check
before the dereference.
Found by PostgresPro
Signed-off-by: Maksim Korotkov <m.korotkov at postgrespro.ru>
diff --git a/liblwgeom/lwgeom_wrapx.c b/liblwgeom/lwgeom_wrapx.c
index 593905cc0..94a651685 100644
--- a/liblwgeom/lwgeom_wrapx.c
+++ b/liblwgeom/lwgeom_wrapx.c
@@ -193,6 +193,7 @@ lwgeom_wrapx(const LWGEOM* lwgeom_in, double cutx, double amount)
{
const LWPOINT *pt = lwgeom_as_lwpoint(lwgeom_clone_deep(lwgeom_in));
POINT4D pt4d;
+ if ( ! pt ) return NULL;
getPoint4d_p(pt->point, 0, &pt4d);
LWDEBUGF(2, "POINT X is %g, cutx:%g, amount:%g", pt4d.x, cutx, amount);
-----------------------------------------------------------------------
Summary of changes:
NEWS | 2 ++
liblwgeom/lwgeom_wrapx.c | 2 ++
raster/loader/raster2pgsql.c | 2 ++
raster/rt_core/rt_mapalgebra.c | 8 +++++---
4 files changed, 11 insertions(+), 3 deletions(-)
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list