[SCM] PostGIS branch stable-3.6 updated. 3.6.4-12-g741f2aa59

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, stable-3.6 has been updated
       via  741f2aa59ec463cde5bb79e4dd15fb79c37196ee (commit)
       via  94d1aa1deada9520fc35405f3648b04db2ef20e3 (commit)
      from  b88a2d7c6054f511590eb239d0bce14c50ea884e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 741f2aa59ec463cde5bb79e4dd15fb79c37196ee
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date:   Tue Jun 23 13:07:41 2026 -0700

    News item for OSSFuzz 525548201

diff --git a/NEWS b/NEWS
index 89130b826..2415100de 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ PostGIS 3.6.5
 - #5989, CurvePolygon distance corner case (Paul Ramsey)
 - #5357, ST_LineFromEncodedPolyline dropping close points (Paul Ramsey)
 - OSSFuzz 525554772, avoid signed integer overflow (Even Rouault)
+- OSSFuzz 525548201, avoid overly nested inputs (Darafei Praliaskouski)
 
 
 PostGIS 3.6.4

commit 94d1aa1deada9520fc35405f3648b04db2ef20e3
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date:   Tue Jun 23 19:42:15 2026 +0000

    OSSFuzz 5121296892231680, avoid overly nested inputs

diff --git a/liblwgeom/cunit/cu_in_twkb.c b/liblwgeom/cunit/cu_in_twkb.c
index c7643faca..d99e4c026 100644
--- a/liblwgeom/cunit/cu_in_twkb.c
+++ b/liblwgeom/cunit/cu_in_twkb.c
@@ -255,9 +255,39 @@ test_twkb_in_coordinate_delta_overflow(void)
 	 */
 	ASSERT_STRING_EQUAL(cu_error_msg, "");
 	CU_ASSERT_PTR_NOT_NULL(geom);
-	if (geom != NULL)
-		lwgeom_free(geom);
+	lwgeom_free(geom);
+}
+
+
+static void
+test_twkb_in_deep_collection(void)
+{
+	const size_t ngeoms = 201;
+	const size_t twkb_size = ngeoms * 3 + 2;
+	uint8_t *twkb = lwalloc(twkb_size);
+	LWGEOM *geom;
+	size_t i;
+
+	for (i = 0; i < ngeoms; i++)
+	{
+		/* GEOMETRYCOLLECTION with default precision and one child. */
+		twkb[3 * i] = 0x07;
+		twkb[3 * i + 1] = 0x00;
+		twkb[3 * i + 2] = 0x01;
+	}
+	twkb[3 * ngeoms] = 0x01;     /* POINT with default precision. */
+	twkb[3 * ngeoms + 1] = 0x10; /* Empty geometry. */
+
 	cu_error_msg_reset();
+
+	geom = lwgeom_from_twkb(twkb, twkb_size, LW_PARSER_CHECK_NONE);
+
+	/* Recursive collection parsing must reject hostile nesting before the C
+	 * stack becomes the effective input validator.
+	 */
+	ASSERT_STRING_EQUAL(cu_error_msg, "Geometry has too many chained collections");
+	CU_ASSERT_PTR_NULL(geom);
+	lwfree(twkb);
 }
 
 /*
@@ -276,4 +306,5 @@ void twkb_in_suite_setup(void)
 	PG_ADD_TEST(suite, test_twkb_in_collection);
 	PG_ADD_TEST(suite, test_twkb_in_precision);
 	PG_ADD_TEST(suite, test_twkb_in_coordinate_delta_overflow);
+	PG_ADD_TEST(suite, test_twkb_in_deep_collection);
 }
diff --git a/liblwgeom/lwin_twkb.c b/liblwgeom/lwin_twkb.c
index 5066f613d..49950da1a 100644
--- a/liblwgeom/lwin_twkb.c
+++ b/liblwgeom/lwin_twkb.c
@@ -29,6 +29,8 @@
 #include "varint.h"
 
 #define TWKB_IN_MAXCOORDS 4
+/** Max depth in a geometry. Matches the WKB parser recursion limit. */
+#define LW_PARSER_MAX_DEPTH 200
 
 /**
 * Used for passing the parse state between the parsing functions.
@@ -42,6 +44,7 @@ typedef struct
 
 	uint32_t check; /* Simple validity checks on geometries */
 	uint32_t lwtype; /* Current type we are handling */
+	uint8_t depth;   /* Current recursion level, to prevent stack overflows */
 
 	uint8_t has_bbox;
 	uint8_t has_size;
@@ -467,6 +470,7 @@ static LWCOLLECTION* lwcollection_from_twkb_state(twkb_parse_state *s)
 	int ngeoms, i;
 	LWGEOM *geom = NULL;
 	LWCOLLECTION *col = lwcollection_construct_empty(s->lwtype, SRID_UNKNOWN, s->has_z, s->has_m);
+	uint8_t start_depth = s->depth;
 
 	LWDEBUG(2,"Entering lwcollection_from_twkb_state");
 
@@ -485,16 +489,28 @@ static LWCOLLECTION* lwcollection_from_twkb_state(twkb_parse_state *s)
 			twkb_parse_state_varint_skip(s);
 	}
 
+	s->depth++;
+	if (s->depth >= LW_PARSER_MAX_DEPTH)
+	{
+		lwcollection_free(col);
+		lwerror("Geometry has too many chained collections");
+		s->depth = start_depth;
+		return NULL;
+	}
+
 	for ( i = 0; i < ngeoms; i++ )
 	{
 		geom = lwgeom_from_twkb_state(s);
-		if ( lwcollection_add_lwgeom(col, geom) == NULL )
+		if (!geom || lwcollection_add_lwgeom(col, geom) == NULL)
 		{
-			lwerror("Unable to add geometry (%p) to collection (%p)", (void *) geom, (void *) col);
+			lwgeom_free(geom);
+			lwcollection_free(col);
+			s->depth = start_depth;
 			return NULL;
 		}
 	}
 
+	s->depth--;
 
 	return col;
 }
@@ -648,7 +664,7 @@ LWGEOM* lwgeom_from_twkb_state(twkb_parse_state *s)
 			break;
 	}
 
-	if ( has_bbox )
+	if (has_bbox && geom)
 		geom->bbox = gbox_clone(&bbox);
 
 	return geom;

-----------------------------------------------------------------------

Summary of changes:
 NEWS                         |  1 +
 liblwgeom/cunit/cu_in_twkb.c | 35 +++++++++++++++++++++++++++++++++--
 liblwgeom/lwin_twkb.c        | 22 +++++++++++++++++++---
 3 files changed, 53 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
PostGIS