[SCM] PostGIS branch stable-3.4 updated. 3.4.6-19-g80c17c66b
git at osgeo.org
git at osgeo.org
Tue Jun 23 13:08:10 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, stable-3.4 has been updated
via 80c17c66b8b47bf5d090ed7e9571d91508e24cba (commit)
via 7caa19b965a7f43b46fa46a8fa59112f8bfa2cf4 (commit)
via c87feff26b02821afce79de2e79bcb3805d1db07 (commit)
from 02deebafbf3cc3f5fb932c6f919d77193512cf40 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 80c17c66b8b47bf5d090ed7e9571d91508e24cba
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 13:07:47 2026 -0700
News item for OSSFuzz 525548201
diff --git a/NEWS b/NEWS
index eec3e88d6..a736cdc7b 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,7 @@ PostGIS 3.4.7
- #5989, CurvePolygon distance corner case (Paul Ramsey)
- #5357, ST_LineFromEncodedPolyline dropping close points (Paul Ramsey)
- OSSFuzz 525554772, avoid signed integer overflow (Even Rouault)
+ - OSSFuzz 525548201, avoid overly nested inputs (Darafei Praliaskouski)
PostGIS 3.4.6
commit 7caa19b965a7f43b46fa46a8fa59112f8bfa2cf4
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 13:05:02 2026 -0700
checkout v6
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6bc061033..9945ea4f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
# sudo apt-get -y -o Dpkg::Options::="--force-confnew" install docker-ce
- name: 'Check Out'
- uses: actions/checkout at v3
+ uses: actions/checkout at v6
- name: 'Prepare Image'
run: |
diff --git a/.github/workflows/msys.yml b/.github/workflows/msys.yml
index 602f177c2..5a68ee1be 100644
--- a/.github/workflows/msys.yml
+++ b/.github/workflows/msys.yml
@@ -22,7 +22,7 @@ jobs:
steps:
# see https://github.com/msys2/setup-msys2
- name: checkout
- uses: actions/checkout at v3
+ uses: actions/checkout at v6
- name: '${{ matrix.icon }} Setup MSYS2'
uses: msys2/setup-msys2 at v2
with:
commit c87feff26b02821afce79de2e79bcb3805d1db07
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 19:42:15 2026 +0000
OSSFuzz 5121296892231680, avoid overly nested inputs
diff --git a/liblwgeom/cunit/cu_in_twkb.c b/liblwgeom/cunit/cu_in_twkb.c
index d8f24c9d8..77aea6fd6 100644
--- a/liblwgeom/cunit/cu_in_twkb.c
+++ b/liblwgeom/cunit/cu_in_twkb.c
@@ -255,9 +255,39 @@ test_twkb_in_coordinate_delta_overflow(void)
*/
ASSERT_STRING_EQUAL(cu_error_msg, "");
CU_ASSERT_PTR_NOT_NULL(geom);
- if (geom != NULL)
- lwgeom_free(geom);
+ lwgeom_free(geom);
+}
+
+
+static void
+test_twkb_in_deep_collection(void)
+{
+ const size_t ngeoms = 201;
+ const size_t twkb_size = ngeoms * 3 + 2;
+ uint8_t *twkb = lwalloc(twkb_size);
+ LWGEOM *geom;
+ size_t i;
+
+ for (i = 0; i < ngeoms; i++)
+ {
+ /* GEOMETRYCOLLECTION with default precision and one child. */
+ twkb[3 * i] = 0x07;
+ twkb[3 * i + 1] = 0x00;
+ twkb[3 * i + 2] = 0x01;
+ }
+ twkb[3 * ngeoms] = 0x01; /* POINT with default precision. */
+ twkb[3 * ngeoms + 1] = 0x10; /* Empty geometry. */
+
cu_error_msg_reset();
+
+ geom = lwgeom_from_twkb(twkb, twkb_size, LW_PARSER_CHECK_NONE);
+
+ /* Recursive collection parsing must reject hostile nesting before the C
+ * stack becomes the effective input validator.
+ */
+ ASSERT_STRING_EQUAL(cu_error_msg, "Geometry has too many chained collections");
+ CU_ASSERT_PTR_NULL(geom);
+ lwfree(twkb);
}
/*
@@ -276,4 +306,5 @@ void twkb_in_suite_setup(void)
PG_ADD_TEST(suite, test_twkb_in_collection);
PG_ADD_TEST(suite, test_twkb_in_precision);
PG_ADD_TEST(suite, test_twkb_in_coordinate_delta_overflow);
+ PG_ADD_TEST(suite, test_twkb_in_deep_collection);
}
diff --git a/liblwgeom/lwin_twkb.c b/liblwgeom/lwin_twkb.c
index 069a70609..a638449d3 100644
--- a/liblwgeom/lwin_twkb.c
+++ b/liblwgeom/lwin_twkb.c
@@ -29,6 +29,8 @@
#include "varint.h"
#define TWKB_IN_MAXCOORDS 4
+/** Max depth in a geometry. Matches the WKB parser recursion limit. */
+#define LW_PARSER_MAX_DEPTH 200
/**
* Used for passing the parse state between the parsing functions.
@@ -42,6 +44,7 @@ typedef struct
uint32_t check; /* Simple validity checks on geometries */
uint32_t lwtype; /* Current type we are handling */
+ uint8_t depth; /* Current recursion level, to prevent stack overflows */
uint8_t has_bbox;
uint8_t has_size;
@@ -467,6 +470,7 @@ static LWCOLLECTION* lwcollection_from_twkb_state(twkb_parse_state *s)
int ngeoms, i;
LWGEOM *geom = NULL;
LWCOLLECTION *col = lwcollection_construct_empty(s->lwtype, SRID_UNKNOWN, s->has_z, s->has_m);
+ uint8_t start_depth = s->depth;
LWDEBUG(2,"Entering lwcollection_from_twkb_state");
@@ -485,16 +489,28 @@ static LWCOLLECTION* lwcollection_from_twkb_state(twkb_parse_state *s)
twkb_parse_state_varint_skip(s);
}
+ s->depth++;
+ if (s->depth >= LW_PARSER_MAX_DEPTH)
+ {
+ lwcollection_free(col);
+ lwerror("Geometry has too many chained collections");
+ s->depth = start_depth;
+ return NULL;
+ }
+
for ( i = 0; i < ngeoms; i++ )
{
geom = lwgeom_from_twkb_state(s);
- if ( lwcollection_add_lwgeom(col, geom) == NULL )
+ if (!geom || lwcollection_add_lwgeom(col, geom) == NULL)
{
- lwerror("Unable to add geometry (%p) to collection (%p)", geom, col);
+ lwgeom_free(geom);
+ lwcollection_free(col);
+ s->depth = start_depth;
return NULL;
}
}
+ s->depth--;
return col;
}
@@ -648,7 +664,7 @@ LWGEOM* lwgeom_from_twkb_state(twkb_parse_state *s)
break;
}
- if ( has_bbox )
+ if (has_bbox && geom)
geom->bbox = gbox_clone(&bbox);
return geom;
-----------------------------------------------------------------------
Summary of changes:
.github/workflows/ci.yml | 2 +-
.github/workflows/msys.yml | 2 +-
NEWS | 1 +
liblwgeom/cunit/cu_in_twkb.c | 35 +++++++++++++++++++++++++++++++++--
liblwgeom/lwin_twkb.c | 22 +++++++++++++++++++---
5 files changed, 55 insertions(+), 7 deletions(-)
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list