From f0393ae302fa91d64633989e73f838f8cc20c14e Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Sun, 7 Jul 2024 10:53:07 +0200 Subject: [PATCH 1/2] SRP: avoid potential integer overflow when ZNA == INT_MIN Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70095 --- frmts/adrg/srpdataset.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frmts/adrg/srpdataset.cpp b/frmts/adrg/srpdataset.cpp index e507adf25abf..018da7fb2320 100644 --- a/frmts/adrg/srpdataset.cpp +++ b/frmts/adrg/srpdataset.cpp @@ -824,7 +824,7 @@ bool SRPDataset::GetFromRecord(const char *pszFileName, DDFRecord *record) } else { - if (std::abs(ZNA) >= 1 && std::abs(ZNA) <= 60) + if (ZNA >= -60 && ZNA <= 60 && ZNA != 0) { m_oSRS.SetUTM(std::abs(ZNA), ZNA > 0); m_oSRS.SetWellKnownGeogCS("WGS84"); From d91a902c7224bdc2e210b05fbefbdfa3e17060bb Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Sun, 7 Jul 2024 10:57:42 +0200 Subject: [PATCH 2/2] OGRAVCE00Layer::FormPolygonGeometry(): avoid integer overflow when nArcId == INT_MIN Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70096 --- ogr/ogrsf_frmts/avc/ogravce00layer.cpp | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/ogr/ogrsf_frmts/avc/ogravce00layer.cpp b/ogr/ogrsf_frmts/avc/ogravce00layer.cpp index e4f87f5a98d7..6d364338242b 100644 --- a/ogr/ogrsf_frmts/avc/ogravce00layer.cpp +++ b/ogr/ogrsf_frmts/avc/ogravce00layer.cpp @@ -314,8 +314,11 @@ bool OGRAVCE00Layer::FormPolygonGeometry(OGRFeature *poFeature, AVCPal *psPAL) for (int iArc = 0; iArc < psPAL->numArcs; iArc++) { - if (psPAL->pasArcs[iArc].nArcId == 0) + if (psPAL->pasArcs[iArc].nArcId == 0 || + psPAL->pasArcs[iArc].nArcId == INT_MIN) + { continue; + } // If the other side of the line is the same polygon then this // arc is a "bridge" arc and can be discarded. If we don't discard @@ -325,8 +328,8 @@ bool OGRAVCE00Layer::FormPolygonGeometry(OGRFeature *poFeature, AVCPal *psPAL) if (psPAL->pasArcs[iArc].nAdjPoly == psPAL->nPolyId) continue; - OGRFeature *poArc = - poArcLayer->GetFeature(std::abs(psPAL->pasArcs[iArc].nArcId)); + auto poArc = std::unique_ptr( + poArcLayer->GetFeature(std::abs(psPAL->pasArcs[iArc].nArcId))); if (poArc == nullptr) return false; @@ -334,8 +337,7 @@ bool OGRAVCE00Layer::FormPolygonGeometry(OGRFeature *poFeature, AVCPal *psPAL) if (poArc->GetGeometryRef() == nullptr) return false; - oArcs.addGeometry(poArc->GetGeometryRef()); - OGRFeature::DestroyFeature(poArc); + oArcs.addGeometryDirectly(poArc->StealGeometry()); } OGRErr eErr;