Merge pull request #518 from rouault/fix_ossfuzz_1809

Avoid potentially very long loop when normalizing longitudes around long_wrap_center
OSGeo · May 23, 2017 · adc0331 · adc0331
2 parents a54611f + 9ebed24
commit adc0331
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 9 deletions.
diff --git a/src/pj_init.c b/src/pj_init.c
@@ -559,7 +559,16 @@ pj_init_ctx(projCtx ctx, int argc, char **argv) {
     /* longitude center for wrapping */
     PIN->is_long_wrap_set = pj_param(ctx, start, "tlon_wrap").i;
     if (PIN->is_long_wrap_set)
+    {
         PIN->long_wrap_center = pj_param(ctx, start, "rlon_wrap").f;
+        /* Don't accept excessive values otherwise we might perform badly */
+        /* when correcting longitudes around it */
+        if( !(fabs(PIN->long_wrap_center) < 10 * M_TWOPI) )
+        {
+            pj_ctx_set_errno( ctx, -14 );
+            goto bum_call;
+        }
+    }
 
     /* axis orientation */
     if( (pj_param(ctx, start,"saxis").s) != NULL )
@@ -584,10 +593,6 @@ pj_init_ctx(projCtx ctx, int argc, char **argv) {
         strcpy( PIN->axis, axis_arg );
     }
 
-    PIN->is_long_wrap_set = pj_param(ctx, start, "tlon_wrap").i;
-    if (PIN->is_long_wrap_set)
-        PIN->long_wrap_center = pj_param(ctx, start, "rlon_wrap").f;
-
     /* central meridian */
     PIN->lam0=pj_param(ctx, start, "rlon_0").f;
 

diff --git a/src/pj_transform.c b/src/pj_transform.c
@@ -422,13 +422,17 @@ int pj_transform( PJ *srcdefn, PJ *dstdefn, long point_count, int point_offset,
     {
         for( i = 0; i < point_count; i++ )
         {
-            if( x[point_offset*i] == HUGE_VAL )
+            double val = x[point_offset*i];
+            if( val == HUGE_VAL )
                 continue;
 
-            while( x[point_offset*i] < dstdefn->long_wrap_center - M_PI )
-                x[point_offset*i] += M_TWOPI;
-            while( x[point_offset*i] > dstdefn->long_wrap_center + M_PI )
-                x[point_offset*i] -= M_TWOPI;
+            /* Get fast in ] -2 PI, 2 PI [ range */
+            val = fmod(val, M_TWOPI);
+            while( val < dstdefn->long_wrap_center - M_PI )
+                val += M_TWOPI;
+            while( val > dstdefn->long_wrap_center + M_PI )
+                val -= M_TWOPI;
+            x[point_offset*i] = val;
         }
     }