validate property value bounds in flatgeobuf_decode_properties#7545
validate property value bounds in flatgeobuf_decode_properties#7545nvxbug wants to merge 2 commits into
Conversation
flatgeobuf_decode_feature ignored the return of flatgeobuf_decode_properties, so a feature rejected for an out-of-bounds property length was still handed back with unset values, which crashed the WFS query path on the NULL value. Propagate the failure so the feature is skipped. Add a msautotest case with a one-feature data/flatgeobuf-invalid.fgb whose string property claims more bytes than the property blob holds; a WFS GetFeature request now returns a clean service exception instead of reading past the buffer.
|
Added a test under msautotest/misc/. While wiring it up I found that |
rouault
added
Security
backport branch-8-6
4 participants
AddressSanitizer, on a crafted .fgb feature whose string property length field claims more bytes than the property blob holds:
flatgeobuf_decode_properties walks a feature property blob taken straight from the file (feature->properties()->data()/size()). The loop only checks that the 2-byte column index fits; the value payload is never bounded against size. For fixed-width columns parse_value dereferences up to 8 bytes past the buffer, and for string/datetime the 4-byte len is read with no cap, so msSmallMalloc(len + 1) wraps to 0 when len is 0xFFFFFFFF and the following memcpy runs off the heap.
Pass size into parse_value and bound both the fixed-width read and the string len against the remaining bytes before touching data.