Opened 11 years ago

Closed 11 years ago

#2218 closed defect (fixed)

[PATCH - shapelib] Fix crashes on corrupted geometries

Reported by: Even Rouault Owned by: Even Rouault
Priority: low Milestone: 1.6.0
Component: OGR_SF Version: unspecified
Severity: normal Keywords: shape
Cc:

Description

The attached patch adds checks to SHPReadObject so that hostile/corrupted geometries in a shape entity don't cause shapelib to read memory outside of the declared entity size and pabyRec buffer.

I've attached too a zip file containing a few volontary corrupted shapefiles to demonstrate the crashes (or Valgrind errors) and the fix.

Attachments (2)

buggyshape.zip (2.4 KB) - added by Even Rouault 11 years ago.
shapelib_fix_crash_on_buggy_geometries.patch (11.4 KB) - added by Even Rouault 11 years ago.

Download all attachments as: .zip

Change History (7)

comment:1 Changed 11 years ago by Even Rouault

Patch updated that also checks for two big number of points or parts that would cause arithmetic computation overflow, and another test that checks that the panPartStart array is correct (checks of the indices wrt the number of points and that they appear in increasing orders).

ZIP also updated to add another shape that demonstrates the checks on panPartStart.

Changed 11 years ago by Even Rouault

Attachment: buggyshape.zip added

Changed 11 years ago by Even Rouault

comment:2 Changed 11 years ago by warmerdam

Milestone: 1.5.1
Priority: normalhigh
Status: newassigned

I'll try to incorporate this for 1.5.1.

comment:3 Changed 11 years ago by warmerdam

Milestone: 1.5.11.6.0
Priority: highlow

Patch applied in Shapelib.

Patch downstreamed and applied in trunk (r14000) and 1.5 branch (r14001).

I would appreciate it if some sort of test case(s) could be added to the gdalautotest. Leaving open for that (in trunk only would be fine).

comment:4 Changed 11 years ago by Even Rouault

Owner: changed from warmerdam to Even Rouault
Status: assignednew

I will take care of adding test cases in gdalautotest. There will be based on the shapefiles in the buggyshape.zip archive

comment:5 Changed 11 years ago by Even Rouault

Resolution: fixed
Status: newclosed

ogr_shape_21 test added in r14015

Note: See TracTickets for help on using tickets.