Skip to content

bound WKB point reads to the Z/M byte stride in mappostgis - #7593

Open
nvxbug wants to merge 1 commit into
MapServer:mainfrom
nvxbug:wkb-point-stride-bounds
Open

bound WKB point reads to the Z/M byte stride in mappostgis#7593
nvxbug wants to merge 1 commit into
MapServer:mainfrom
nvxbug:wkb-point-stride-bounds

Conversation

@nvxbug

@nvxbug nvxbug commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

AddressSanitizer, reading a Z LineString whose point count clears the old check:

READ of size 8 at 0x6070000000d4 thread T0
    #0 wkbReadPointP
0x6070000000d4 is located 0 bytes after 68-byte region

wkbReadLine bounds the point count against the bytes left divided by 16, but wkbReadPointP reads 24 bytes per point for a Z or M geometry and 32 for ZM, so a Z/M linestring or polygon ring can read past the WKB buffer returned by a PostGIS query. arcStrokeCircularString had no such check at all and read its whole odd point count unbounded. Both now derive the per-point stride from the Z/M flags before reading. wkbReadLine also clears the lineObj on the reject path, since msAddLineDirectly takes ownership of line->point and the early return previously left it uninitialized.

What are related issues/pull requests?

None.

AI tool usage

Tasklist

  • Make sure code is correctly formatted (cf pre-commit configuration)
  • Add test case(s) in /msautotest (follow steps in Regression Testing)
  • Add documentation
  • Review
  • Adjust for comments
  • All CI builds and checks have passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant