[SCM] PostGIS branch stable-3.3 updated. 3.3.10-17-g5802fccea
git at osgeo.org
git at osgeo.org
Tue Jun 23 13:08:12 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, stable-3.3 has been updated
via 5802fcceacc56bc8f0bef8746c7f615a719fada7 (commit)
via 3ac0ce9ce074901bfdfe3ef7a26904cd180943a1 (commit)
via 25fba64468a5fb8b5a99a040f6e3bcb2026360bd (commit)
from ebb7fa94d8566759a7d17788203d2d4c51af9251 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 5802fcceacc56bc8f0bef8746c7f615a719fada7
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 13:07:48 2026 -0700
News item for OSSFuzz 525548201
diff --git a/NEWS b/NEWS
index 990128c02..ad5468f05 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PostGIS 3.3.11
- #5916, ST_Split hang with very large ordinates (Paul Ramsey)
- #5989, CurvePolygon distance corner case (Paul Ramsey)
- OSSFuzz 525554772, avoid signed integer overflow (Even Rouault)
+ - OSSFuzz 525548201, avoid overly nested inputs (Darafei Praliaskouski)
PostGIS 3.3.10
commit 3ac0ce9ce074901bfdfe3ef7a26904cd180943a1
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 13:05:11 2026 -0700
checkout v6
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9948f2c57..d79f9234d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
# sudo apt-get -y -o Dpkg::Options::="--force-confnew" install docker-ce
- name: 'Check Out'
- uses: actions/checkout at v2
+ uses: actions/checkout at v6
- name: 'Prepare Image'
run: |
diff --git a/.github/workflows/msys.yml b/.github/workflows/msys.yml
index abbd824e5..f80c2cacf 100644
--- a/.github/workflows/msys.yml
+++ b/.github/workflows/msys.yml
@@ -21,7 +21,7 @@ jobs:
steps:
# see https://github.com/msys2/setup-msys2
- name: checkout
- uses: actions/checkout at v2
+ uses: actions/checkout at v6
- name: '${{ matrix.icon }} Setup MSYS2'
uses: msys2/setup-msys2 at v2
with:
commit 25fba64468a5fb8b5a99a040f6e3bcb2026360bd
Author: Paul Ramsey <pramsey at cleverelephant.ca>
Date: Tue Jun 23 19:42:15 2026 +0000
OSSFuzz 5121296892231680, avoid overly nested inputs
diff --git a/liblwgeom/cunit/cu_in_twkb.c b/liblwgeom/cunit/cu_in_twkb.c
index d8f24c9d8..77aea6fd6 100644
--- a/liblwgeom/cunit/cu_in_twkb.c
+++ b/liblwgeom/cunit/cu_in_twkb.c
@@ -255,9 +255,39 @@ test_twkb_in_coordinate_delta_overflow(void)
*/
ASSERT_STRING_EQUAL(cu_error_msg, "");
CU_ASSERT_PTR_NOT_NULL(geom);
- if (geom != NULL)
- lwgeom_free(geom);
+ lwgeom_free(geom);
+}
+
+
+static void
+test_twkb_in_deep_collection(void)
+{
+ const size_t ngeoms = 201;
+ const size_t twkb_size = ngeoms * 3 + 2;
+ uint8_t *twkb = lwalloc(twkb_size);
+ LWGEOM *geom;
+ size_t i;
+
+ for (i = 0; i < ngeoms; i++)
+ {
+ /* GEOMETRYCOLLECTION with default precision and one child. */
+ twkb[3 * i] = 0x07;
+ twkb[3 * i + 1] = 0x00;
+ twkb[3 * i + 2] = 0x01;
+ }
+ twkb[3 * ngeoms] = 0x01; /* POINT with default precision. */
+ twkb[3 * ngeoms + 1] = 0x10; /* Empty geometry. */
+
cu_error_msg_reset();
+
+ geom = lwgeom_from_twkb(twkb, twkb_size, LW_PARSER_CHECK_NONE);
+
+ /* Recursive collection parsing must reject hostile nesting before the C
+ * stack becomes the effective input validator.
+ */
+ ASSERT_STRING_EQUAL(cu_error_msg, "Geometry has too many chained collections");
+ CU_ASSERT_PTR_NULL(geom);
+ lwfree(twkb);
}
/*
@@ -276,4 +306,5 @@ void twkb_in_suite_setup(void)
PG_ADD_TEST(suite, test_twkb_in_collection);
PG_ADD_TEST(suite, test_twkb_in_precision);
PG_ADD_TEST(suite, test_twkb_in_coordinate_delta_overflow);
+ PG_ADD_TEST(suite, test_twkb_in_deep_collection);
}
diff --git a/liblwgeom/lwin_twkb.c b/liblwgeom/lwin_twkb.c
index 069a70609..a638449d3 100644
--- a/liblwgeom/lwin_twkb.c
+++ b/liblwgeom/lwin_twkb.c
@@ -29,6 +29,8 @@
#include "varint.h"
#define TWKB_IN_MAXCOORDS 4
+/** Max depth in a geometry. Matches the WKB parser recursion limit. */
+#define LW_PARSER_MAX_DEPTH 200
/**
* Used for passing the parse state between the parsing functions.
@@ -42,6 +44,7 @@ typedef struct
uint32_t check; /* Simple validity checks on geometries */
uint32_t lwtype; /* Current type we are handling */
+ uint8_t depth; /* Current recursion level, to prevent stack overflows */
uint8_t has_bbox;
uint8_t has_size;
@@ -467,6 +470,7 @@ static LWCOLLECTION* lwcollection_from_twkb_state(twkb_parse_state *s)
int ngeoms, i;
LWGEOM *geom = NULL;
LWCOLLECTION *col = lwcollection_construct_empty(s->lwtype, SRID_UNKNOWN, s->has_z, s->has_m);
+ uint8_t start_depth = s->depth;
LWDEBUG(2,"Entering lwcollection_from_twkb_state");
@@ -485,16 +489,28 @@ static LWCOLLECTION* lwcollection_from_twkb_state(twkb_parse_state *s)
twkb_parse_state_varint_skip(s);
}
+ s->depth++;
+ if (s->depth >= LW_PARSER_MAX_DEPTH)
+ {
+ lwcollection_free(col);
+ lwerror("Geometry has too many chained collections");
+ s->depth = start_depth;
+ return NULL;
+ }
+
for ( i = 0; i < ngeoms; i++ )
{
geom = lwgeom_from_twkb_state(s);
- if ( lwcollection_add_lwgeom(col, geom) == NULL )
+ if (!geom || lwcollection_add_lwgeom(col, geom) == NULL)
{
- lwerror("Unable to add geometry (%p) to collection (%p)", geom, col);
+ lwgeom_free(geom);
+ lwcollection_free(col);
+ s->depth = start_depth;
return NULL;
}
}
+ s->depth--;
return col;
}
@@ -648,7 +664,7 @@ LWGEOM* lwgeom_from_twkb_state(twkb_parse_state *s)
break;
}
- if ( has_bbox )
+ if (has_bbox && geom)
geom->bbox = gbox_clone(&bbox);
return geom;
-----------------------------------------------------------------------
Summary of changes:
.github/workflows/ci.yml | 2 +-
.github/workflows/msys.yml | 2 +-
NEWS | 1 +
liblwgeom/cunit/cu_in_twkb.c | 35 +++++++++++++++++++++++++++++++++--
liblwgeom/lwin_twkb.c | 22 +++++++++++++++++++---
5 files changed, 55 insertions(+), 7 deletions(-)
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list