[SCM] PostGIS branch stable-3.5 updated. 3.5.7-5-ge496c9b39
git at osgeo.org
git at osgeo.org
Tue Jun 23 10:36:52 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, stable-3.5 has been updated
via e496c9b399740e66aa77c623693a6799394311b6 (commit)
via bd62edda08c9090135f5e7d1f90353e374d31fba (commit)
via 7edd266fd42a8f42b4de59411599899fbc749c65 (commit)
from af18826ce1375c9bd518a7bf6e71e9bc4b4bfdff (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit e496c9b399740e66aa77c623693a6799394311b6
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 10:36:25 2026 -0700
News entry for OSSFuzz 525554772
diff --git a/NEWS b/NEWS
index 4fd2190ae..506a1c565 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PostGIS 3.5.7
- #5916, ST_Split hang with very large ordinates (Paul Ramsey)
- #5989, CurvePolygon distance corner case (Paul Ramsey)
- #5357, ST_LineFromEncodedPolyline dropping close points (Paul Ramsey)
+ - OSSFuzz 525554772, avoid signed integer overflow (Even Rouault)
PostGIS 3.5.6
commit bd62edda08c9090135f5e7d1f90353e374d31fba
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 10:32:25 2026 -0700
checkout v6
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 120c7f25d..c2c7797a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
# sudo apt-get -y -o Dpkg::Options::="--force-confnew" install docker-ce
- name: 'Check Out'
- uses: actions/checkout at v3
+ uses: actions/checkout at v6
- name: 'Prepare Image'
run: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e6e1ae234..eb6420645 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,7 +37,7 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout at v4
+ uses: actions/checkout at v6
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
diff --git a/.github/workflows/msys.yml b/.github/workflows/msys.yml
index 602f177c2..5a68ee1be 100644
--- a/.github/workflows/msys.yml
+++ b/.github/workflows/msys.yml
@@ -22,7 +22,7 @@ jobs:
steps:
# see https://github.com/msys2/setup-msys2
- name: checkout
- uses: actions/checkout at v3
+ uses: actions/checkout at v6
- name: '${{ matrix.icon }} Setup MSYS2'
uses: msys2/setup-msys2 at v2
with:
commit 7edd266fd42a8f42b4de59411599899fbc749c65
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 10:23:43 2026 -0700
Fix to OSSFuzz https://issues.oss-fuzz.com/issues/525554772
ptarray_from_twkb_state(): avoid signed integer overflow
From Even Rouault, @rouault
diff --git a/liblwgeom/cunit/cu_in_twkb.c b/liblwgeom/cunit/cu_in_twkb.c
index 5e0f0cfd0..11acecd4d 100644
--- a/liblwgeom/cunit/cu_in_twkb.c
+++ b/liblwgeom/cunit/cu_in_twkb.c
@@ -224,6 +224,42 @@ static void test_twkb_in_precision(void)
+static void
+test_twkb_in_coordinate_delta_overflow(void)
+{
+ const uint8_t twkb[] = {0x02, /* LINESTRING with default precision. */
+ 0x00,
+ 0x02, /* Two points. */
+ 0xfe,
+ 0xff,
+ 0xff,
+ 0xff,
+ 0xff,
+ 0xff, /* X = INT64_MAX. */
+ 0xff,
+ 0xff,
+ 0xff,
+ 0x01,
+ 0x00, /* Y = 0. */
+ 0x02, /* X delta = 1. */
+ 0x00};
+ LWGEOM *geom;
+
+ cu_error_msg_reset();
+
+ geom = lwgeom_from_twkb(twkb, sizeof(twkb), LW_PARSER_CHECK_NONE);
+
+ /* TWKB stores coordinate deltas as signed integers. Malformed or fuzzed
+ * inputs can wrap the accumulated delta; the parser must make that wrap
+ * explicit instead of relying on undefined signed-overflow behaviour.
+ */
+ ASSERT_STRING_EQUAL(cu_error_msg, "");
+ CU_ASSERT_PTR_NOT_NULL(geom);
+ if (geom != NULL)
+ lwgeom_free(geom);
+ cu_error_msg_reset();
+}
+
/*
** Used by test harness to register the tests in this file.
*/
@@ -239,4 +275,5 @@ void twkb_in_suite_setup(void)
PG_ADD_TEST(suite, test_twkb_in_multipolygon);
PG_ADD_TEST(suite, test_twkb_in_collection);
PG_ADD_TEST(suite, test_twkb_in_precision);
+ PG_ADD_TEST(suite, test_twkb_in_coordinate_delta_overflow);
}
diff --git a/liblwgeom/lwin_twkb.c b/liblwgeom/lwin_twkb.c
index 72fc53306..5066f613d 100644
--- a/liblwgeom/lwin_twkb.c
+++ b/liblwgeom/lwin_twkb.c
@@ -164,6 +164,19 @@ static uint8_t byte_from_twkb_state(twkb_parse_state *s)
return val;
}
+/** Implements *pa += b in a sanitizer friendly way, using wrap around
+ * logic in case of overflow
+ */
+#if __clang_major__ >= 4
+__attribute__((no_sanitize("unsigned-integer-overflow")))
+#endif
+static inline void safe_add_int64(int64_t* pa, int64_t b)
+{
+ uint64_t u_a = (uint64_t)*pa;
+ uint64_t u_b = (uint64_t)b;
+ u_a += u_b;
+ memcpy(pa, &u_a, sizeof(int64_t));
+}
/**
* POINTARRAY
@@ -189,24 +202,24 @@ static POINTARRAY* ptarray_from_twkb_state(twkb_parse_state *s, uint32_t npoints
{
int j = 0;
/* X */
- s->coords[j] += twkb_parse_state_varint(s);
+ safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
dlist[ndims*i + j] = s->coords[j] / s->factor;
j++;
/* Y */
- s->coords[j] += twkb_parse_state_varint(s);
+ safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
dlist[ndims*i + j] = s->coords[j] / s->factor;
j++;
/* Z */
if ( s->has_z )
{
- s->coords[j] += twkb_parse_state_varint(s);
+ safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
dlist[ndims*i + j] = s->coords[j] / s->factor_z;
j++;
}
/* M */
if ( s->has_m )
{
- s->coords[j] += twkb_parse_state_varint(s);
+ safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
dlist[ndims*i + j] = s->coords[j] / s->factor_m;
j++;
}
-----------------------------------------------------------------------
Summary of changes:
.github/workflows/ci.yml | 2 +-
.github/workflows/codeql.yml | 2 +-
.github/workflows/msys.yml | 2 +-
NEWS | 1 +
liblwgeom/cunit/cu_in_twkb.c | 37 +++++++++++++++++++++++++++++++++++++
liblwgeom/lwin_twkb.c | 21 +++++++++++++++++----
6 files changed, 58 insertions(+), 7 deletions(-)
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list