Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ossfuzz fixes #9265

Merged
merged 3 commits into from
Feb 22, 2024
Merged

Ossfuzz fixes #9265

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0c14536
GDALWMSDataset::Initialize(): avoid potential integer overflow (fixes…
rouault Feb 20, 2024
7967a18
GDALDeserializeGCPListFromXML(): fix memleak in error code path (mast…
rouault Feb 20, 2024
47c9b59
VRTComplexSource::RasterIOProcessNoData(): avoid potential assertion …
rouault Feb 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions frmts/vrt/vrtsources.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3010,7 +3010,9 @@ CPLErr VRTComplexSource::RasterIOProcessNoData(
// Cannot overflow since pData should at least have that number of
// elements
const size_t nPixelCount = static_cast<size_t>(nOutXSize) * nOutYSize;
if (nPixelCount > std::numeric_limits<size_t>::max() / sizeof(SourceDT))
if (nPixelCount >
static_cast<size_t>(std::numeric_limits<ptrdiff_t>::max()) /
sizeof(SourceDT))
{
CPLError(CE_Failure, CPLE_OutOfMemory,
"Too large temporary buffer");
Expand Down Expand Up @@ -3226,8 +3228,9 @@ CPLErr VRTComplexSource::RasterIOInternal(
{
// Cannot overflow since pData should at least have that number of
// elements
if (nPixelCount > std::numeric_limits<size_t>::max() /
static_cast<size_t>(nWordSize))
if (nPixelCount >
static_cast<size_t>(std::numeric_limits<ptrdiff_t>::max()) /
static_cast<size_t>(nWordSize))
{
CPLError(CE_Failure, CPLE_OutOfMemory,
"Too large temporary buffer");
Expand Down
44 changes: 42 additions & 2 deletions frmts/wms/gdalwmsdataset.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -471,6 +471,13 @@ CPLErr GDALWMSDataset::Initialize(CPLXMLNode *config, char **l_papszOpenOptions)
}

m_data_window.m_tlevel = atoi(tlevel);
// Limit to 30 to avoid 1 << m_tlevel overflow
if (m_data_window.m_tlevel < 0 || m_data_window.m_tlevel > 30)
{
CPLError(CE_Failure, CPLE_AppDefined,
"Invalid value for TileLevel");
return CE_Failure;
}

if (ret == CE_None)
{
Expand All @@ -483,10 +490,43 @@ CPLErr GDALWMSDataset::Initialize(CPLXMLNode *config, char **l_papszOpenOptions)
(str_tile_count_x[0] != '\0') &&
(str_tile_count_y[0] != '\0'))
{
int tile_count_x = atoi(str_tile_count_x);
int tile_count_y = atoi(str_tile_count_y);
const int tile_count_x = atoi(str_tile_count_x);
if (tile_count_x <= 0)
{
CPLError(CE_Failure, CPLE_AppDefined,
"Invalid value for TileCountX");
return CE_Failure;
}
if (tile_count_x > INT_MAX / m_block_size_x ||
tile_count_x * m_block_size_x >
INT_MAX / (1 << m_data_window.m_tlevel))
{
CPLError(CE_Failure, CPLE_AppDefined,
"Integer overflow in tile_count_x * "
"m_block_size_x * (1 << "
"m_data_window.m_tlevel)");
return CE_Failure;
}
m_data_window.m_sx = tile_count_x * m_block_size_x *
(1 << m_data_window.m_tlevel);

const int tile_count_y = atoi(str_tile_count_y);
if (tile_count_y <= 0)
{
CPLError(CE_Failure, CPLE_AppDefined,
"Invalid value for TileCountY");
return CE_Failure;
}
if (tile_count_y > INT_MAX / m_block_size_y ||
tile_count_y * m_block_size_y >
INT_MAX / (1 << m_data_window.m_tlevel))
{
CPLError(CE_Failure, CPLE_AppDefined,
"Integer overflow in tile_count_y * "
"m_block_size_y * (1 << "
"m_data_window.m_tlevel)");
return CE_Failure;
}
m_data_window.m_sy = tile_count_y * m_block_size_y *
(1 << m_data_window.m_tlevel);
}
Expand Down
20 changes: 14 additions & 6 deletions gcore/gdal_misc.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4224,14 +4224,15 @@ void GDALDeserializeGCPListFromXML(CPLXMLNode *psGCPList,
return true;
};

bool bOK = true;
if (!ParseDoubleValue("Pixel", psGCP->dfGCPPixel))
continue;
bOK = false;
if (!ParseDoubleValue("Line", psGCP->dfGCPLine))
continue;
bOK = false;
if (!ParseDoubleValue("X", psGCP->dfGCPX))
continue;
bOK = false;
if (!ParseDoubleValue("Y", psGCP->dfGCPY))
continue;
bOK = false;
const char *pszZ = CPLGetXMLValue(psXMLGCP, "Z", nullptr);
if (pszZ == nullptr)
{
Expand All @@ -4245,10 +4246,17 @@ void GDALDeserializeGCPListFromXML(CPLXMLNode *psGCPList,
{
CPLError(CE_Failure, CPLE_AppDefined,
"GCP#Z=%s is an invalid value", pszZ);
continue;
bOK = false;
}

(*pnGCPCount)++;
if (!bOK)
{
GDALDeinitGCPs(1, psGCP);
}
else
{
(*pnGCPCount)++;
}
}
}

Expand Down
Loading