GeographicBoundingBox::intersection(): avoid infinite recursion and s…

…tack overflow on invalid bounding boxes Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57328
OSGeo · Jun 17, 2023 · 15728da · 15728da
1 parent 718a528
commit 15728da
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 7 deletions.
diff --git a/src/iso19111/metadata.cpp b/src/iso19111/metadata.cpp
@@ -422,6 +422,9 @@ GeographicBoundingBox::Private::intersection(const Private &otherExtent) const {
         }
 
         // Return larger of two parts of the multipolygon
+        if (oW > 180 || oE < -180) {
+            return nullptr;
+        }
         auto inter1 = intersection(Private(oW, oS, 180.0, oN));
         auto inter2 = intersection(Private(-180.0, oS, oE, oN));
         if (!inter1) {

diff --git a/test/unit/test_metadata.cpp b/test/unit/test_metadata.cpp
@@ -284,13 +284,15 @@ TEST(metadata, extent_edge_cases) {
         optional<std::string>(), std::vector<GeographicExtentNNPtr>(),
         std::vector<VerticalExtentNNPtr>(), std::vector<TemporalExtentNNPtr>());
 
-    auto A = Extent::createFromBBOX(-180, -90, 180, 90);
-    auto B = Extent::createFromBBOX(180, -90, 180, 90);
-    EXPECT_FALSE(A->intersects(B));
-    EXPECT_FALSE(B->intersects(A));
-    EXPECT_FALSE(A->contains(B));
-    EXPECT_TRUE(A->intersection(B) == nullptr);
-    EXPECT_TRUE(B->intersection(A) == nullptr);
+    {
+        auto A = Extent::createFromBBOX(-180, -90, 180, 90);
+        auto B = Extent::createFromBBOX(180, -90, 180, 90);
+        EXPECT_FALSE(A->intersects(B));
+        EXPECT_FALSE(B->intersects(A));
+        EXPECT_FALSE(A->contains(B));
+        EXPECT_TRUE(A->intersection(B) == nullptr);
+        EXPECT_TRUE(B->intersection(A) == nullptr);
+    }
 
     EXPECT_THROW(Extent::createFromBBOX(
                      std::numeric_limits<double>::quiet_NaN(), -90, 180, 90),
@@ -304,6 +306,20 @@ TEST(metadata, extent_edge_cases) {
     EXPECT_THROW(Extent::createFromBBOX(
                      -180, -90, 180, std::numeric_limits<double>::quiet_NaN()),
                  InvalidValueTypeException);
+
+    // Scenario of https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57328
+    {
+        auto A = Extent::createFromBBOX(0, 1, 2, 3);
+        auto B = Extent::createFromBBOX(200, -80, -100, 80);
+        EXPECT_TRUE(A->intersection(B) == nullptr);
+        EXPECT_TRUE(B->intersection(A) == nullptr);
+    }
+    {
+        auto A = Extent::createFromBBOX(0, 1, 2, 3);
+        auto B = Extent::createFromBBOX(100, -80, -200, 80);
+        EXPECT_TRUE(A->intersection(B) == nullptr);
+        EXPECT_TRUE(B->intersection(A) == nullptr);
+    }
 }
 
 // ---------------------------------------------------------------------------