[SCM] PostGIS branch stable-3.6 updated. 3.6.4-9-gb4cf97c0a

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, stable-3.6 has been updated
       via  b4cf97c0a86705458f78eb465ddab79d3f1c52c1 (commit)
       via  07ce7561845b55a526f58a2c7d3c7d55f0b787bb (commit)
      from  84829064ea5a5824334a0c038eec20cc81f58ab1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b4cf97c0a86705458f78eb465ddab79d3f1c52c1
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date:   Tue Jun 23 10:30:54 2026 -0700

    checkout v6

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c5d9abf47..008a2b476 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
     #     sudo apt-get -y -o Dpkg::Options::="--force-confnew" install docker-ce
 
     - name: 'Check Out'
-      uses: actions/checkout at v3
+      uses: actions/checkout at v6
 
     - name: 'Prepare Image'
       run: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9ee56b72a..ff3fa0261 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout at v4
+      uses: actions/checkout at v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/msys.yml b/.github/workflows/msys.yml
index 602f177c2..5a68ee1be 100644
--- a/.github/workflows/msys.yml
+++ b/.github/workflows/msys.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
       # see https://github.com/msys2/setup-msys2
     - name: checkout
-      uses: actions/checkout at v3
+      uses: actions/checkout at v6
     - name: '${{ matrix.icon }} Setup MSYS2'
       uses: msys2/setup-msys2 at v2
       with:

commit 07ce7561845b55a526f58a2c7d3c7d55f0b787bb
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date:   Tue Jun 23 10:23:43 2026 -0700

    Fix to OSSFuzz https://issues.oss-fuzz.com/issues/525554772
    ptarray_from_twkb_state(): avoid signed integer overflow
    From Even Rouault, @rouault

diff --git a/liblwgeom/cunit/cu_in_twkb.c b/liblwgeom/cunit/cu_in_twkb.c
index 02d2db374..c7643faca 100644
--- a/liblwgeom/cunit/cu_in_twkb.c
+++ b/liblwgeom/cunit/cu_in_twkb.c
@@ -224,6 +224,42 @@ static void test_twkb_in_precision(void)
 
 
 
+static void
+test_twkb_in_coordinate_delta_overflow(void)
+{
+	const uint8_t twkb[] = {0x02, /* LINESTRING with default precision. */
+				0x00,
+				0x02, /* Two points. */
+				0xfe,
+				0xff,
+				0xff,
+				0xff,
+				0xff,
+				0xff, /* X = INT64_MAX. */
+				0xff,
+				0xff,
+				0xff,
+				0x01,
+				0x00, /* Y = 0. */
+				0x02, /* X delta = 1. */
+				0x00};
+	LWGEOM *geom;
+
+	cu_error_msg_reset();
+
+	geom = lwgeom_from_twkb(twkb, sizeof(twkb), LW_PARSER_CHECK_NONE);
+
+	/* TWKB stores coordinate deltas as signed integers. Malformed or fuzzed
+	 * inputs can wrap the accumulated delta; the parser must make that wrap
+	 * explicit instead of relying on undefined signed-overflow behaviour.
+	 */
+	ASSERT_STRING_EQUAL(cu_error_msg, "");
+	CU_ASSERT_PTR_NOT_NULL(geom);
+	if (geom != NULL)
+		lwgeom_free(geom);
+	cu_error_msg_reset();
+}
+
 /*
 ** Used by test harness to register the tests in this file.
 */
@@ -239,4 +275,5 @@ void twkb_in_suite_setup(void)
 	PG_ADD_TEST(suite, test_twkb_in_multipolygon);
 	PG_ADD_TEST(suite, test_twkb_in_collection);
 	PG_ADD_TEST(suite, test_twkb_in_precision);
+	PG_ADD_TEST(suite, test_twkb_in_coordinate_delta_overflow);
 }
diff --git a/liblwgeom/lwin_twkb.c b/liblwgeom/lwin_twkb.c
index 72fc53306..5066f613d 100644
--- a/liblwgeom/lwin_twkb.c
+++ b/liblwgeom/lwin_twkb.c
@@ -164,6 +164,19 @@ static uint8_t byte_from_twkb_state(twkb_parse_state *s)
 	return val;
 }
 
+/** Implements *pa += b in a sanitizer friendly way, using wrap around
+ * logic in case of overflow
+ */
+#if __clang_major__ >= 4
+__attribute__((no_sanitize("unsigned-integer-overflow")))
+#endif
+static inline void safe_add_int64(int64_t* pa, int64_t b)
+{
+	uint64_t u_a = (uint64_t)*pa;
+	uint64_t u_b = (uint64_t)b;
+	u_a += u_b;
+	memcpy(pa, &u_a, sizeof(int64_t));
+}
 
 /**
 * POINTARRAY
@@ -189,24 +202,24 @@ static POINTARRAY* ptarray_from_twkb_state(twkb_parse_state *s, uint32_t npoints
 	{
 		int j = 0;
 		/* X */
-		s->coords[j] += twkb_parse_state_varint(s);
+		safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
 		dlist[ndims*i + j] = s->coords[j] / s->factor;
 		j++;
 		/* Y */
-		s->coords[j] += twkb_parse_state_varint(s);
+		safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
 		dlist[ndims*i + j] = s->coords[j] / s->factor;
 		j++;
 		/* Z */
 		if ( s->has_z )
 		{
-			s->coords[j] += twkb_parse_state_varint(s);
+			safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
 			dlist[ndims*i + j] = s->coords[j] / s->factor_z;
 			j++;
 		}
 		/* M */
 		if ( s->has_m )
 		{
-			s->coords[j] += twkb_parse_state_varint(s);
+			safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
 			dlist[ndims*i + j] = s->coords[j] / s->factor_m;
 			j++;
 		}

-----------------------------------------------------------------------

Summary of changes:
 .github/workflows/ci.yml     |  2 +-
 .github/workflows/codeql.yml |  2 +-
 .github/workflows/msys.yml   |  2 +-
 liblwgeom/cunit/cu_in_twkb.c | 37 +++++++++++++++++++++++++++++++++++++
 liblwgeom/lwin_twkb.c        | 21 +++++++++++++++++----
 5 files changed, 57 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
PostGIS