[PostGIS] #6109: Out-of-bounds heap read in BOX2D_out and BOX2D_expand on 65-byte box2d under ASAN

[PostGIS]

#6109: Out-of-bounds heap read in BOX2D_out and BOX2D_expand on 65-byte box2d
under ASAN
---------------------+---------------------------
 Reporter:  dtighe   |      Owner:  pramsey
     Type:  defect   |     Status:  new
 Priority:  medium   |  Milestone:  PostGIS 3.6.5
Component:  postgis  |    Version:  3.6.x
 Keywords:           |
---------------------+---------------------------
 The box2d type is defined with internallength=65 (65 bytes stored
 payload). However, in C source code (postgis/lwgeom_box.c), functions
 operating on box2d (BOX2D_out and BOX2D_expand) cast the input pointer
 (GBOX *)PG_GETARG_POINTER(0) and copy sizeof(GBOX) bytes (72 bytes) using
 memcpy. Because a materialized box2d is only 65 bytes long, copying
 sizeof(GBOX) (72 bytes) reads 7 bytes out-of-bounds past the end of the
 heap allocation.

 This shows up under ASAN, but operates normally under non-ASAN builds.

 Repro:
 {{{
 SELECT ('LINESTRING(0 0,1 1)'::geometry::box2d)::text;
 }}}

 Root cause:

 In `postgis/lwgeom_box.c`:

 BOX2D_out:
 {{{
    GBOX *box = (GBOX *)PG_GETARG_POINTER(0);
    GBOX box_aligned;
    memcpy(&box_aligned, box, sizeof(GBOX));  /* sizeof(GBOX) == 72 */
 }}}
 BOX2D_expand:
 {{{
    GBOX *box = (GBOX *)PG_GETARG_POINTER(0);
    GBOX *result = (GBOX *)palloc(sizeof(GBOX));
    memcpy(result, box, sizeof(GBOX));        /* sizeof(GBOX) == 72 */
 }}}

 The fix should be to update the memcpy's to:
 `memcpy(&box_aligned, box, offsetof(GBOX, zmin));` which covers the
 required fields.
-- 
Ticket URL: <https://trac.osgeo.org/postgis/ticket/6109>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.