[SCM] PostGIS branch master updated. 3.7.0beta1-62-g4db1d75e0
git at osgeo.org
git at osgeo.org
Mon Jul 27 09:09:37 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, master has been updated
via 4db1d75e03357463c86703dc3fad39972d0ac60c (commit)
via b76210d7907abc3a7a4bf38b0dbf93194dde36a2 (commit)
from 05b8993652abbc9894a0435b59573c7ad92636b5 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 4db1d75e03357463c86703dc3fad39972d0ac60c
Merge: 05b899365 b76210d79
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date: Mon Jul 27 09:09:36 2026 -0700
Merge pull request 'Guard raster band size calculations' (!556) from Komzpa/postgis:codex/raster-band-size-overflow-20260727 into master
Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/556
commit b76210d7907abc3a7a4bf38b0dbf93194dde36a2
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Mon Jul 27 12:04:57 2026 +0400
Guard raster band size calculations
diff --git a/raster/rt_core/rt_band.c b/raster/rt_core/rt_band.c
index cace34bfc..5d7117744 100644
--- a/raster/rt_core/rt_band.c
+++ b/raster/rt_core/rt_band.c
@@ -11,7 +11,7 @@
* Copyright (C) 2009-2011 Pierre Racine <pierre.racine at sbf.ulaval.ca>
* Copyright (C) 2009-2011 Mateusz Loskot <mateusz at loskot.net>
* Copyright (C) 2008-2009 Sandro Santilli <strk at kbt.io>
- * Copyright (C) 2025 Darafei Praliaskouski <me at komzpa.net>
+ * Copyright (C) 2025-2026 Darafei Praliaskouski <me at komzpa.net>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
@@ -119,9 +119,10 @@ rt_band_init_value(
rt_pixtype pixtype = band->pixtype;
uint32_t width = band->width;
uint32_t height = band->height;
- uint32_t numval = width * height;
+ size_t numval = (size_t)width * height;
void *mem = band->data.mem;
- size_t memsize = numval * rt_pixtype_size(pixtype);
+ int pixbytes = rt_pixtype_size(pixtype);
+ size_t memsize;
/* initialize to nodataval */
int32_t checkvalint = 0;
@@ -129,6 +130,13 @@ rt_band_init_value(
double checkvaldouble = 0;
float checkvalfloat = 0;
+ if (pixbytes < 1 || numval > SIZE_MAX / (size_t)pixbytes)
+ {
+ rterror("rt_band_init_value: Raster dimensions are too large for band initialization");
+ return;
+ }
+ memsize = numval * (size_t)pixbytes;
+
/* initialize to zero */
if (FLT_EQ(initval, 0.0)) {
memset(mem, 0, memsize);
@@ -140,7 +148,7 @@ rt_band_init_value(
{
uint8_t *ptr = mem;
uint8_t clamped_initval = rt_util_clamp_to_1BB(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalint = ptr[0];
break;
@@ -149,7 +157,7 @@ rt_band_init_value(
{
uint8_t *ptr = mem;
uint8_t clamped_initval = rt_util_clamp_to_2BUI(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalint = ptr[0];
break;
@@ -158,7 +166,7 @@ rt_band_init_value(
{
uint8_t *ptr = mem;
uint8_t clamped_initval = rt_util_clamp_to_4BUI(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalint = ptr[0];
break;
@@ -167,7 +175,7 @@ rt_band_init_value(
{
int8_t *ptr = mem;
int8_t clamped_initval = rt_util_clamp_to_8BSI(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalint = ptr[0];
break;
@@ -176,7 +184,7 @@ rt_band_init_value(
{
uint8_t *ptr = mem;
uint8_t clamped_initval = rt_util_clamp_to_8BUI(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalint = ptr[0];
break;
@@ -185,7 +193,7 @@ rt_band_init_value(
{
int16_t *ptr = mem;
int16_t clamped_initval = rt_util_clamp_to_16BSI(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalint = ptr[0];
break;
@@ -193,7 +201,7 @@ rt_band_init_value(
case PT_16BUI: {
uint16_t *ptr = mem;
uint16_t clamped_initval = rt_util_clamp_to_16BUI(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalint = ptr[0];
break;
@@ -202,7 +210,7 @@ rt_band_init_value(
uint16_t *ptr = mem;
float clamped_initval = rt_util_clamp_to_16F(initval);
uint16_t packed = rt_util_float_to_float16(clamped_initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = packed;
checkvalfloat = rt_util_float16_to_float(ptr[0]);
break;
@@ -210,7 +218,7 @@ rt_band_init_value(
case PT_32BSI: {
int32_t *ptr = mem;
int32_t clamped_initval = rt_util_clamp_to_32BSI(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalint = ptr[0];
break;
@@ -219,7 +227,7 @@ rt_band_init_value(
{
uint32_t *ptr = mem;
uint32_t clamped_initval = rt_util_clamp_to_32BUI(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvaluint = ptr[0];
break;
@@ -228,7 +236,7 @@ rt_band_init_value(
{
float *ptr = mem;
float clamped_initval = rt_util_clamp_to_32F(initval);
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = clamped_initval;
checkvalfloat = ptr[0];
break;
@@ -236,7 +244,7 @@ rt_band_init_value(
case PT_64BF:
{
double *ptr = mem;
- for (uint32_t i = 0; i < numval; i++)
+ for (size_t i = 0; i < numval; i++)
ptr[i] = initval;
checkvaldouble = ptr[0];
break;
diff --git a/raster/rt_core/rt_raster.c b/raster/rt_core/rt_raster.c
index 1c2bbb9f2..9d5fe7c38 100644
--- a/raster/rt_core/rt_raster.c
+++ b/raster/rt_core/rt_raster.c
@@ -493,10 +493,11 @@ rt_raster_generate_new_band(
int index
) {
rt_band band = NULL;
- int width = 0;
- int height = 0;
- int numval = 0;
- int datasize = 0;
+ uint16_t width = 0;
+ uint16_t height = 0;
+ size_t numval = 0;
+ size_t datasize = 0;
+ int pixbytes = 0;
int oldnumbands = 0;
int numbands = 0;
void * mem = NULL;
@@ -513,8 +514,19 @@ rt_raster_generate_new_band(
/* Determine size of memory block to allocate and allocate it */
width = rt_raster_get_width(raster);
height = rt_raster_get_height(raster);
- numval = width * height;
- datasize = rt_pixtype_size(pixtype) * numval;
+ pixbytes = rt_pixtype_size(pixtype);
+ if (pixbytes < 1)
+ {
+ rterror("rt_raster_generate_new_band: Invalid pixel type for band allocation");
+ return -1;
+ }
+ numval = (size_t)width * height;
+ if (numval > UINT32_MAX / (size_t)pixbytes)
+ {
+ rterror("rt_raster_generate_new_band: Raster dimensions are too large for band allocation");
+ return -1;
+ }
+ datasize = numval * (size_t)pixbytes;
mem = (int *)rtalloc(datasize);
if (!mem) {
diff --git a/raster/test/cunit/cu_raster_basics.c b/raster/test/cunit/cu_raster_basics.c
index ad68cba9d..e8eac73a7 100644
--- a/raster/test/cunit/cu_raster_basics.c
+++ b/raster/test/cunit/cu_raster_basics.c
@@ -4,6 +4,7 @@
*
* Copyright (C) 2012 Regents of the University of California
* <bkpark at ucdavis.edu>
+ * Copyright (C) 2026 Darafei Praliaskouski <me at komzpa.net>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
@@ -204,6 +205,24 @@ static void test_raster_replace_band(void) {
cu_free_raster(raster);
}
+static void
+test_raster_generate_new_band_size_overflow(void)
+{
+ rt_raster raster;
+ int bandnum;
+
+ raster = rt_raster_new(UINT16_MAX, UINT16_MAX);
+ CU_ASSERT_PTR_NOT_NULL_FATAL(raster);
+
+ cu_error_msg_reset();
+ bandnum = rt_raster_generate_new_band(raster, PT_64BF, 0, 0, 0, -1);
+ CU_ASSERT_EQUAL(bandnum, -1);
+ CU_ASSERT_STRING_EQUAL(cu_error_msg,
+ "rt_raster_generate_new_band: Raster dimensions are too large for band allocation");
+
+ rt_raster_destroy(raster);
+}
+
/* register tests */
void raster_basics_suite_setup(void);
void raster_basics_suite_setup(void)
@@ -215,5 +234,5 @@ void raster_basics_suite_setup(void)
PG_ADD_TEST(suite, test_raster_clone);
PG_ADD_TEST(suite, test_raster_from_band);
PG_ADD_TEST(suite, test_raster_replace_band);
+ PG_ADD_TEST(suite, test_raster_generate_new_band_size_overflow);
}
-
-----------------------------------------------------------------------
Summary of changes:
raster/rt_core/rt_band.c | 38 ++++++++++++++++++++++--------------
raster/rt_core/rt_raster.c | 24 +++++++++++++++++------
raster/test/cunit/cu_raster_basics.c | 21 +++++++++++++++++++-
3 files changed, 61 insertions(+), 22 deletions(-)
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list