mapquery: reject out-of-range layer index in loadQueryResults - #7608
mapquery: reject out-of-range layer index in loadQueryResults#7608nvxbug wants to merge 2 commits into
Conversation
Sorry, something went wrong.
|
@nvxbug please include a test for this in /msautotest (use an existing map or create one), follow https://mapserver.org/development/tests/autotest.html |
Sorry, something went wrong.
|
Done. Added an msautotest case in msautotest/query: a new queryfile.map (two inline layers) plus a crafted data/queryfile_index_oob.qy whose layer index equals numlayers, loaded through mode=nquery&queryfile=. Without the fix mapserv segfaults on it; with the fix the run produces the expected "Invalid layer index loaded from query file" output (expected/queryfile_test001.txt). Verified both ways locally with the pytest harness, and the query suite still passes. Kept the unit test as well. |
Sorry, something went wrong.
What does this PR do?
loadQueryResults() reads back a saved query file (the queryfile CGI parameter, through msLoadQuery) and checks each layer index it reads from the file with j > map->numlayers. That bound is off by one: j == map->numlayers passes, and GET_LAYER(map, j) then indexes map->layers one slot past the last valid layer. map->layers is grown in MS_LAYER_ALLOCSIZE (64) chunks, so when the number of layers fills a chunk the array is packed and map->layers[numlayers] reads a pointer past the allocation, which is then dereferenced to store resultcache.
AddressSanitizer, crafted .qy file with the layer index set to numlayers over a full 64-layer chunk:
==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8 #0 msLoadQuery mapquery.cpp:613 0x... is located 0 bytes after 512-byte region [0x...100,0x...300) allocated by thread T0 here: #1 msGrowMapLayers mapfile.c:6446The comparison should be >=, which is what every other layer-index check in this file already uses. A regression test in tests/unit/test.cpp builds a full 64-layer map, feeds a query file whose index equals numlayers, and asserts msLoadQuery returns MS_FAILURE; a valid block still loads.
What are related issues/pull requests?
None.
AI tool usage
Tasklist