[SCM] PostGIS branch stable-3.4 updated. 3.4.6-16-g02deebafb

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, stable-3.4 has been updated
       via  02deebafbf3cc3f5fb932c6f919d77193512cf40 (commit)
       via  e991815f9db53b6403f80535712c146f9129958b (commit)
      from  24ea85852f981ae830f145b31f552932d3a1b698 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 02deebafbf3cc3f5fb932c6f919d77193512cf40
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date:   Tue Jun 23 10:36:28 2026 -0700

    News entry for OSSFuzz 525554772

diff --git a/NEWS b/NEWS
index 5f9ced28d..eec3e88d6 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PostGIS 3.4.7
   - #5916, ST_Split hang with very large ordinates (Paul Ramsey)
   - #5989, CurvePolygon distance corner case (Paul Ramsey)
   - #5357, ST_LineFromEncodedPolyline dropping close points (Paul Ramsey)
+  - OSSFuzz 525554772, avoid signed integer overflow (Even Rouault)
 
 
 PostGIS 3.4.6

commit e991815f9db53b6403f80535712c146f9129958b
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date:   Tue Jun 23 10:23:43 2026 -0700

    Fix to OSSFuzz https://issues.oss-fuzz.com/issues/525554772
    ptarray_from_twkb_state(): avoid signed integer overflow
    From Even Rouault, @rouault

diff --git a/liblwgeom/cunit/cu_in_twkb.c b/liblwgeom/cunit/cu_in_twkb.c
index 6dcc39a96..d8f24c9d8 100644
--- a/liblwgeom/cunit/cu_in_twkb.c
+++ b/liblwgeom/cunit/cu_in_twkb.c
@@ -224,6 +224,42 @@ static void test_twkb_in_precision(void)
 
 
 
+static void
+test_twkb_in_coordinate_delta_overflow(void)
+{
+	const uint8_t twkb[] = {0x02, /* LINESTRING with default precision. */
+				0x00,
+				0x02, /* Two points. */
+				0xfe,
+				0xff,
+				0xff,
+				0xff,
+				0xff,
+				0xff, /* X = INT64_MAX. */
+				0xff,
+				0xff,
+				0xff,
+				0x01,
+				0x00, /* Y = 0. */
+				0x02, /* X delta = 1. */
+				0x00};
+	LWGEOM *geom;
+
+	cu_error_msg_reset();
+
+	geom = lwgeom_from_twkb(twkb, sizeof(twkb), LW_PARSER_CHECK_NONE);
+
+	/* TWKB stores coordinate deltas as signed integers. Malformed or fuzzed
+	 * inputs can wrap the accumulated delta; the parser must make that wrap
+	 * explicit instead of relying on undefined signed-overflow behaviour.
+	 */
+	ASSERT_STRING_EQUAL(cu_error_msg, "");
+	CU_ASSERT_PTR_NOT_NULL(geom);
+	if (geom != NULL)
+		lwgeom_free(geom);
+	cu_error_msg_reset();
+}
+
 /*
 ** Used by test harness to register the tests in this file.
 */
@@ -239,4 +275,5 @@ void twkb_in_suite_setup(void)
 	PG_ADD_TEST(suite, test_twkb_in_multipolygon);
 	PG_ADD_TEST(suite, test_twkb_in_collection);
 	PG_ADD_TEST(suite, test_twkb_in_precision);
+	PG_ADD_TEST(suite, test_twkb_in_coordinate_delta_overflow);
 }
diff --git a/liblwgeom/lwin_twkb.c b/liblwgeom/lwin_twkb.c
index 445b4a9b0..069a70609 100644
--- a/liblwgeom/lwin_twkb.c
+++ b/liblwgeom/lwin_twkb.c
@@ -164,6 +164,19 @@ static uint8_t byte_from_twkb_state(twkb_parse_state *s)
 	return val;
 }
 
+/** Implements *pa += b in a sanitizer friendly way, using wrap around
+ * logic in case of overflow
+ */
+#if __clang_major__ >= 4
+__attribute__((no_sanitize("unsigned-integer-overflow")))
+#endif
+static inline void safe_add_int64(int64_t* pa, int64_t b)
+{
+	uint64_t u_a = (uint64_t)*pa;
+	uint64_t u_b = (uint64_t)b;
+	u_a += u_b;
+	memcpy(pa, &u_a, sizeof(int64_t));
+}
 
 /**
 * POINTARRAY
@@ -189,24 +202,24 @@ static POINTARRAY* ptarray_from_twkb_state(twkb_parse_state *s, uint32_t npoints
 	{
 		int j = 0;
 		/* X */
-		s->coords[j] += twkb_parse_state_varint(s);
+		safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
 		dlist[ndims*i + j] = s->coords[j] / s->factor;
 		j++;
 		/* Y */
-		s->coords[j] += twkb_parse_state_varint(s);
+		safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
 		dlist[ndims*i + j] = s->coords[j] / s->factor;
 		j++;
 		/* Z */
 		if ( s->has_z )
 		{
-			s->coords[j] += twkb_parse_state_varint(s);
+			safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
 			dlist[ndims*i + j] = s->coords[j] / s->factor_z;
 			j++;
 		}
 		/* M */
 		if ( s->has_m )
 		{
-			s->coords[j] += twkb_parse_state_varint(s);
+			safe_add_int64(&(s->coords[j]), twkb_parse_state_varint(s));
 			dlist[ndims*i + j] = s->coords[j] / s->factor_m;
 			j++;
 		}

-----------------------------------------------------------------------

Summary of changes:
 NEWS                         |  1 +
 liblwgeom/cunit/cu_in_twkb.c | 37 +++++++++++++++++++++++++++++++++++++
 liblwgeom/lwin_twkb.c        | 21 +++++++++++++++++----
 3 files changed, 55 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
PostGIS