[PostGIS] #6146: BOX3D_combine () crashes on null argument

[PostGIS]

#6146: BOX3D_combine () crashes on null argument
--------------------------+---------------------------
 Reporter:  alexanderlaw  |      Owner:  pramsey
     Type:  defect        |     Status:  new
 Priority:  medium        |  Milestone:  PostGIS 3.7.1
Component:  postgis       |    Version:  master
 Keywords:                |
--------------------------+---------------------------
 The following script:
 {{{
 CREATE TABLE t(x box2d); INSERT INTO t VALUES (NULL);
 SELECT st_combinebbox(CASE WHEN x IS NULL THEN box3d(x) END,
 NULL::geometry) FROM t;
 }}}


 triggers a server crash:
 {{{
 INSERT 0 1
 server closed the connection unexpectedly
         This probably means the server terminated abnormally
         before or while processing the request.
 }}}


 {{{
 Core was generated by `postgres: law pgis_test [local] SELECT '.
 Program terminated with signal SIGSEGV, Segmentation fault.
 (gdb) bt
 #0  memcpy (__len=56, __src=0x1, __dest=0x6130a02db4b0) at
 /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
 #1  BOX3D_combine (fcinfo=0x6130a02d51a8) at lwgeom_box3d.c:518
 #2  0x0000613076e3ccd9 in ExecInterpExpr (state=0x6130a02d4c40,
 econtext=0x6130a02d47d8, isnull=0x0) at execExprInterp.c:936
 ...
 #16 0x000061307716cff8 in exec_simple_query (
     query_string=0x6130a0190020 "SELECT st_combinebbox(CASE WHEN x IS NULL
 THEN box3d(x) END, NULL::geometry) FROM t;") at postgres.c:1290
 }}}


 This function checks argument 1 for null, but not argument 0:
 {{{
 PG_FUNCTION_INFO_V1(BOX3D_combine);
 Datum BOX3D_combine(PG_FUNCTION_ARGS)
 {
         BOX3D *box = (BOX3D *)PG_GETARG_POINTER(0);
         GSERIALIZED *geom = PG_ARGISNULL(1) ? NULL : (GSERIALIZED
 *)PG_DETOAST_DATUM(PG_GETARG_DATUM(1));
 ...
         /* Null geometry but non-null box, return the box */
         else if (!geom)
         {
                 result = palloc(sizeof(BOX3D));
                 memcpy(result, box, sizeof(BOX3D));
                 PG_RETURN_POINTER(result);
         }
 }}}

 SELECT postgis_full_version()
 {{{
 POSTGIS="3.7.0rc3 3.7.0rc1-119-gdcc888996" [EXTENSION] PGSQL="190"
 GEOS="3.12.1-CAPI-1.18.1" PROJ="9.4.0 NETWORK_ENABLED=OFF
 URL_ENDPOINT=https://cdn.proj.org USER_WRITABLE_DIRECTORY=...
 DATABASE_PATH=/usr/share/proj/proj.db" (compiled against PROJ 9.4.0)
 LIBXML="2.9.14" LIBJSON="0.17" LIBPROTOBUF="1.4.1" WAGYU="0.5.0
 (Internal)"
 }}}

 Discovered by SQLsmith test run at Databricks.
-- 
Ticket URL: <https://trac.osgeo.org/postgis/ticket/6146>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.