search

go-spatial / geom

Geometry interfaces to help drive interoperability within the Go geospatial community
MIT License
168 stars 37 forks source link

Fuzzing wkb encoding causes out of memory errors #384 #21

Open gdey opened 6 years ago

gdey commented 6 years ago

Ref: https://github.com/go-spatial/tegola/issues/384

Fuzzing geom/encoding/wkb (as per #53) reveals a potential bug with several decode functions. I have attached the relevant test output - 010c1c076fce1acae227d578d230bd713dd44528.txt

https://github.com/go-spatial/tegola/blob/2d90e68580efc38a85e3b6c4ad020a80bf66095a/geom/encoding/wkb/internal/decode/decode.go#L155

In this case, the out of memory error occurs when the Collection function reads the number of items num from the WKB byte stream. In this case it is because of a fuzzed value. When thinking of how to sanitize the input I initially thought it might be sufficient to check it was within a sane range. As far as I can tell, however, there is no documented upper limit for the number of Points in a given geometry (Polygons, Collections etc) in WKB other than math.MaxUint32 (4294967295).

This also affects the other geometry decoding functions that use the value returned from the WKB byte stream to do slice allocation:

https://github.com/go-spatial/tegola/blob/2d90e68580efc38a85e3b6c4ad020a80bf66095a/geom/encoding/wkb/internal/decode/decode.go#L134

https://github.com/go-spatial/tegola/blob/2d90e68580efc38a85e3b6c4ad020a80bf66095a/geom/encoding/wkb/internal/decode/decode.go#L120

https://github.com/go-spatial/tegola/blob/2d90e68580efc38a85e3b6c4ad020a80bf66095a/geom/encoding/wkb/internal/decode/decode.go#L99

https://github.com/go-spatial/tegola/blob/2d90e68580efc38a85e3b6c4ad020a80bf66095a/geom/encoding/wkb/internal/decode/decode.go#L78

https://github.com/go-spatial/tegola/blob/2d90e68580efc38a85e3b6c4ad020a80bf66095a/geom/encoding/wkb/internal/decode/decode.go#L64

https://github.com/go-spatial/tegola/blob/2d90e68580efc38a85e3b6c4ad020a80bf66095a/geom/encoding/wkb/internal/decode/decode.go#L41

gdey commented 6 years ago

I'm not sure what we can do about this issue at current keeping it open to research it. Please, reference the original: https://github.com/go-spatial/tegola/issues/384

gdey commented 6 years ago

https://github.com/golang/go/issues/16843 Add a reference to underlining go issue.