[SCM] PostGIS branch master updated. 3.7.0beta1-84-g8a7bf4fe01
git at osgeo.org
git at osgeo.org
Mon Jul 27 13:13:40 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, master has been updated
via 8a7bf4fe01ddf247a4d056e6e3feaaae512134b0 (commit)
via f0db4a4e9addcde9c7e75b8befa5ad51df8dc889 (commit)
via 7f3fd06c5097fddb94f76a69414856892b11114b (commit)
from bbf00872510c92d78b1bdaae297652378b353f95 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 8a7bf4fe01ddf247a4d056e6e3feaaae512134b0
Merge: bbf0087251 f0db4a4e9a
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date: Mon Jul 27 13:13:38 2026 -0700
Merge pull request 'Add malformed WKB and TWKB parser tests' (!542) from Komzpa/postgis:test/parser-malformed-wkb-twkb-20260726 into master
Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/542
commit f0db4a4e9addcde9c7e75b8befa5ad51df8dc889
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Mon Jul 27 02:53:30 2026 +0400
Tighten malformed WKB and TWKB parser oracles
diff --git a/liblwgeom/cunit/cu_in_twkb.c b/liblwgeom/cunit/cu_in_twkb.c
index e0e653173d..17c1f85354 100644
--- a/liblwgeom/cunit/cu_in_twkb.c
+++ b/liblwgeom/cunit/cu_in_twkb.c
@@ -243,7 +243,7 @@ test_twkb_in_truncated_extended_dims(void)
* out-of-buffer read while constructing the header.
*/
ASSERT_STRING_EQUAL(cu_error_msg, "twkb_parse_state_advance: TWKB structure does not match expected size!");
- CU_ASSERT_PTR_NOT_NULL(geom);
+ CU_ASSERT_PTR_NULL(geom);
if (geom != NULL)
lwgeom_free(geom);
cu_error_msg_reset();
@@ -275,6 +275,7 @@ test_twkb_in_overlong_varint(void)
* than the C type width before the parser could report malformed input.
*/
ASSERT_STRING_EQUAL(cu_error_msg, "varint_u64_decode: varint exceeds 64 bits");
+ CU_ASSERT_PTR_NULL(geom);
if (geom != NULL)
lwgeom_free(geom);
cu_error_msg_reset();
@@ -303,6 +304,7 @@ test_twkb_in_count_exceeds_payload(void)
*/
ASSERT_STRING_EQUAL(cu_error_msg,
"twkb_parse_state_has_min_bytes: TWKB element count exceeds remaining payload");
+ CU_ASSERT_PTR_NULL(geom);
if (geom != NULL)
lwgeom_free(geom);
cu_error_msg_reset();
@@ -359,6 +361,7 @@ test_twkb_in_coordinate_delta_wraparound(void)
* wrap hostile inputs into the int64_t accumulator range.
*/
CU_ASSERT(strstr(cu_error_msg, "called with n=0 and npoints=0") != NULL);
+ CU_ASSERT_PTR_NULL(geom);
if (geom != NULL)
lwgeom_free(geom);
cu_error_msg_reset();
diff --git a/liblwgeom/cunit/cu_in_wkb.c b/liblwgeom/cunit/cu_in_wkb.c
index 2566567ab0..64cbff40e0 100644
--- a/liblwgeom/cunit/cu_in_wkb.c
+++ b/liblwgeom/cunit/cu_in_wkb.c
@@ -332,6 +332,7 @@ test_wkb_in_invalid_endian_flag(void)
geom = lwgeom_from_wkb(wkb, sizeof(wkb), LW_PARSER_CHECK_NONE);
ASSERT_STRING_EQUAL(cu_error_msg, "Invalid endian flag value encountered.");
+ CU_ASSERT_PTR_NULL(geom);
if (geom != NULL)
lwgeom_free(geom);
cu_error_msg_reset();
diff --git a/liblwgeom/lwin_twkb.c b/liblwgeom/lwin_twkb.c
index ad5dcd0c62..dc5ebd6ec9 100644
--- a/liblwgeom/lwin_twkb.c
+++ b/liblwgeom/lwin_twkb.c
@@ -54,6 +54,7 @@ typedef struct
uint8_t has_z;
uint8_t has_m;
uint8_t is_empty;
+ uint8_t error;
/* Precision factors to convert ints to double */
double factor;
@@ -86,10 +87,14 @@ LWGEOM* lwgeom_from_twkb_state(twkb_parse_state *s);
*/
static inline void twkb_parse_state_advance(twkb_parse_state *s, size_t next)
{
- if (next > (size_t)(s->twkb_end - s->pos))
+ size_t remaining = (s->pos <= s->twkb_end) ? (size_t)(s->twkb_end - s->pos) : 0;
+
+ if (next > remaining)
{
+ s->error = LW_TRUE;
lwerror("%s: TWKB structure does not match expected size!", __func__);
- // lwnotice("TWKB structure does not match expected size!");
+ s->pos = s->twkb_end;
+ return;
}
s->pos += next;
@@ -99,6 +104,8 @@ static inline int64_t twkb_parse_state_varint(twkb_parse_state *s)
{
size_t size;
int64_t val = varint_s64_decode(s->pos, s->twkb_end, &size);
+ if (size == 0)
+ s->error = LW_TRUE;
twkb_parse_state_advance(s, size);
return val;
}
@@ -107,6 +114,8 @@ static inline uint64_t twkb_parse_state_uvarint(twkb_parse_state *s)
{
size_t size;
uint64_t val = varint_u64_decode(s->pos, s->twkb_end, &size);
+ if (size == 0)
+ s->error = LW_TRUE;
twkb_parse_state_advance(s, size);
return val;
}
@@ -115,6 +124,8 @@ static inline double twkb_parse_state_double(twkb_parse_state *s, double factor)
{
size_t size;
int64_t val = varint_s64_decode(s->pos, s->twkb_end, &size);
+ if (size == 0)
+ s->error = LW_TRUE;
twkb_parse_state_advance(s, size);
return val / factor;
}
@@ -124,7 +135,10 @@ static inline void twkb_parse_state_varint_skip(twkb_parse_state *s)
size_t size = varint_size(s->pos, s->twkb_end);
if ( ! size )
+ {
+ s->error = LW_TRUE;
lwerror("%s: no varint to skip", __func__);
+ }
twkb_parse_state_advance(s, size);
return;
@@ -137,6 +151,7 @@ twkb_parse_state_uvarint32(twkb_parse_state *s)
if (val > UINT32_MAX)
{
+ s->error = LW_TRUE;
lwerror("%s: TWKB count exceeds uint32_t", __func__);
return 0;
}
@@ -155,6 +170,7 @@ twkb_parse_state_has_min_bytes(twkb_parse_state *s, uint32_t count, size_t min_b
*/
if (min_bytes != 0 && count > remaining / min_bytes)
{
+ s->error = LW_TRUE;
lwerror("%s: TWKB element count exceeds remaining payload", __func__);
return LW_FALSE;
}
@@ -727,10 +743,17 @@ LWGEOM* lwgeom_from_twkb_state(twkb_parse_state *s)
break;
/* Unknown type! */
default:
+ s->error = LW_TRUE;
lwerror("%s: Unsupported geometry type: %s", __func__, lwtype_name(s->lwtype));
break;
}
+ if (s->error)
+ {
+ lwgeom_free(geom);
+ return NULL;
+ }
+
if (has_bbox && geom)
geom->bbox = gbox_clone(&bbox);
diff --git a/liblwgeom/lwin_wkb.c b/liblwgeom/lwin_wkb.c
index de82d2376c..02a7ad90df 100644
--- a/liblwgeom/lwin_wkb.c
+++ b/liblwgeom/lwin_wkb.c
@@ -398,7 +398,10 @@ static void wkb_swap_bytes(wkb_parse_state *s)
lwerror("Invalid endian flag value encountered.");
if( wkb_little_endian != 1 && wkb_little_endian != 0 )
+ {
+ s->error = LW_TRUE;
lwerror("Invalid endian flag value encountered.");
+ }
/* Check the endianness of our input */
s->swap_bytes = LW_FALSE;
commit 7f3fd06c5097fddb94f76a69414856892b11114b
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Sun Jul 26 20:22:16 2026 +0300
Add malformed WKB and TWKB parser tests
diff --git a/liblwgeom/cunit/cu_in_twkb.c b/liblwgeom/cunit/cu_in_twkb.c
index 9b2097e0fc..e0e653173d 100644
--- a/liblwgeom/cunit/cu_in_twkb.c
+++ b/liblwgeom/cunit/cu_in_twkb.c
@@ -387,6 +387,24 @@ test_twkb_in_linestring_coordinate_delta_wraparound(void)
cu_error_msg_reset();
}
+static void
+test_twkb_in_unsupported_type(void)
+{
+ const uint8_t twkb[] = {0x08, /* unsupported TWKB type with default precision. */
+ 0x00};
+ LWGEOM *geom;
+
+ cu_error_msg_reset();
+
+ geom = lwgeom_from_twkb(twkb, sizeof(twkb), LW_PARSER_CHECK_NONE);
+
+ ASSERT_STRING_EQUAL(cu_error_msg, "lwgeom_from_twkb_state: Unsupported geometry type: Unknown");
+ CU_ASSERT_PTR_NULL(geom);
+ if (geom != NULL)
+ lwgeom_free(geom);
+ cu_error_msg_reset();
+}
+
/*
** Used by test harness to register the tests in this file.
*/
@@ -408,4 +426,5 @@ void twkb_in_suite_setup(void)
PG_ADD_TEST(suite, test_twkb_in_deep_collection);
PG_ADD_TEST(suite, test_twkb_in_coordinate_delta_wraparound);
PG_ADD_TEST(suite, test_twkb_in_linestring_coordinate_delta_wraparound);
+ PG_ADD_TEST(suite, test_twkb_in_unsupported_type);
}
diff --git a/liblwgeom/cunit/cu_in_wkb.c b/liblwgeom/cunit/cu_in_wkb.c
index 2d7438c4c1..2566567ab0 100644
--- a/liblwgeom/cunit/cu_in_wkb.c
+++ b/liblwgeom/cunit/cu_in_wkb.c
@@ -319,6 +319,24 @@ test_wkb_in_nurbscurve_count_exceeds_payload(void)
cu_error_msg_reset();
}
+static void
+test_wkb_in_invalid_endian_flag(void)
+{
+ const uint8_t wkb[] = {0x02, /* invalid endian flag */
+ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+ LWGEOM *geom;
+
+ cu_error_msg_reset();
+
+ geom = lwgeom_from_wkb(wkb, sizeof(wkb), LW_PARSER_CHECK_NONE);
+
+ ASSERT_STRING_EQUAL(cu_error_msg, "Invalid endian flag value encountered.");
+ if (geom != NULL)
+ lwgeom_free(geom);
+ cu_error_msg_reset();
+}
+
/*
** Used by test harness to register the tests in this file.
*/
@@ -342,4 +360,5 @@ void wkb_in_suite_setup(void)
PG_ADD_TEST(suite, test_wkb_fuzz);
PG_ADD_TEST(suite, test_wkb_in_linestring_zm_count_exceeds_payload);
PG_ADD_TEST(suite, test_wkb_in_nurbscurve_count_exceeds_payload);
+ PG_ADD_TEST(suite, test_wkb_in_invalid_endian_flag);
}
-----------------------------------------------------------------------
Summary of changes:
liblwgeom/cunit/cu_in_twkb.c | 24 +++++++++++++++++++++++-
liblwgeom/cunit/cu_in_wkb.c | 20 ++++++++++++++++++++
liblwgeom/lwin_twkb.c | 27 +++++++++++++++++++++++++--
liblwgeom/lwin_wkb.c | 3 +++
4 files changed, 71 insertions(+), 3 deletions(-)
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list