Merge pull request #10377 from rouault/fix_ossfuzz_70095_70096

2 ossfuzz integer overflow related fixes
OSGeo · Jul 8, 2024 · 95c20a8 · 95c20a8
2 parents c68b760 + d91a902
commit 95c20a8
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 6 deletions.
diff --git a/frmts/adrg/srpdataset.cpp b/frmts/adrg/srpdataset.cpp
@@ -824,7 +824,7 @@ bool SRPDataset::GetFromRecord(const char *pszFileName, DDFRecord *record)
     }
     else
     {
-        if (std::abs(ZNA) >= 1 && std::abs(ZNA) <= 60)
+        if (ZNA >= -60 && ZNA <= 60 && ZNA != 0)
         {
             m_oSRS.SetUTM(std::abs(ZNA), ZNA > 0);
             m_oSRS.SetWellKnownGeogCS("WGS84");

diff --git a/ogr/ogrsf_frmts/avc/ogravce00layer.cpp b/ogr/ogrsf_frmts/avc/ogravce00layer.cpp
@@ -314,8 +314,11 @@ bool OGRAVCE00Layer::FormPolygonGeometry(OGRFeature *poFeature, AVCPal *psPAL)
 
     for (int iArc = 0; iArc < psPAL->numArcs; iArc++)
     {
-        if (psPAL->pasArcs[iArc].nArcId == 0)
+        if (psPAL->pasArcs[iArc].nArcId == 0 ||
+            psPAL->pasArcs[iArc].nArcId == INT_MIN)
+        {
             continue;
+        }
 
         // If the other side of the line is the same polygon then this
         // arc is a "bridge" arc and can be discarded.  If we don't discard
@@ -325,17 +328,16 @@ bool OGRAVCE00Layer::FormPolygonGeometry(OGRFeature *poFeature, AVCPal *psPAL)
         if (psPAL->pasArcs[iArc].nAdjPoly == psPAL->nPolyId)
             continue;
 
-        OGRFeature *poArc =
-            poArcLayer->GetFeature(std::abs(psPAL->pasArcs[iArc].nArcId));
+        auto poArc = std::unique_ptr<OGRFeature>(
+            poArcLayer->GetFeature(std::abs(psPAL->pasArcs[iArc].nArcId)));
 
         if (poArc == nullptr)
             return false;
 
         if (poArc->GetGeometryRef() == nullptr)
             return false;
 
-        oArcs.addGeometry(poArc->GetGeometryRef());
-        OGRFeature::DestroyFeature(poArc);
+        oArcs.addGeometryDirectly(poArc->StealGeometry());
     }
 
     OGRErr eErr;