Opened 9 years ago

Closed 9 years ago

Last modified 9 years ago

#3135 closed defect (fixed)

ST_SubDivide garden crasher on malformed polygon and linestring

Reported by: robe Owned by: pramsey
Priority: blocker Milestone: PostGIS 2.2.0
Component: postgis Version: master
Keywords: Cc:


I didn't even think it was possible to create a geometry like this. You learn so much from robot monkeys :)

SELECT ST_SubDivide(ST_GeomFromText('POLYGON((1 2,1 2,1 2,1 2))'), 2);

SELECT ST_SubDivide(ST_GeomFromText('LINESTRING(1 2,1 2,1 2,1 2)'), 2);

pramsey you've got to try harder to out smart monkeys :)

Change History (8)

comment:1 by robe, 9 years ago

forgot my install was runnning on PostgreSQL 9.5 dev (about 3 day old install)

POSTGIS="2.2.0dev r13566" GEOS="3.5.0dev-CAPI-1.9.0 r4034" PROJ="Rel. 4.8.0, 6 March 2012" LIBXML="2.7.8" LIBJSON="0.12"

comment:2 by pramsey, 9 years ago

Cc: strk added

This is almost certainly a GEOS crasher, but I'll confirm in gdb.

comment:3 by pramsey, 9 years ago

It's not a GEOS crasher, it's a problem in the recursion w/ the zero-size input.

comment:4 by pramsey, 9 years ago

Fixed at r13576

comment:5 by pramsey, 9 years ago

Resolution: fixed
Status: newclosed

comment:6 by robe, 9 years ago

Resolution: fixed
Status: closedreopened

Not so fast - monkey can still crash your code at r13578 with this:

SELECT ST_SubDivide(ST_GeomFromText('POLYGON((1 2,1 2,1 2,1 2,3 2,1 2))'),2);

comment:7 by pramsey, 9 years ago

Cc: strk removed
Resolution: fixed
Status: reopenedclosed

Your case is "fixed" at r13580, however it's not a perfect fix. It won't crash anymore, no matter what you do, even if you pack your object with enough repeated points to force another infinite recursion because I put in a recursion stopper. If you do try that you'll find the output is "wrong" as the portion of the object with the repeated points just disappears into the aether. The overhead in trying to catch that case and do the "right" thing (which is probably to remove the repeated points) is just too high. Another possibility would be to stuff the whole input object through the repeated points remover right at the start; not sure if we want to do that. My proximate fix, to avoid dropping your slightly repeating input was just to increase the minimum number of vertices we'd guarantee, since my mind boggled at what it meant to ask the function "only return polygons with no more than two vertices in them".

comment:8 by robe, 9 years ago

I see what ya mean squeallie is happy but doc examples don't work.

If it's hard, I suppose I could change the doc examples and we just put a notice that can't go below 16 or whatever we decide.

Note: See TracTickets for help on using tickets.