Merge pull request #1843 from dhensby/fix/udt-parser

fix: improve geography/geometry parser robustness

Author: dhensby

lib/udt.js

@@ -44,6 +44,12 @@ const SEGMENT = {
   FIRST_ARC: 0x03
 }; */
 
+const ensureBytes = (buffer, needed) => {
+  if (buffer.position + needed > buffer.length) {
+    throw new Error(`Corrupt or truncated spatial data: expected ${needed} bytes at position ${buffer.position}, but only ${buffer.length - buffer.position} bytes remain`)
+  }
+}
+
 class Point {
   constructor () {
     this.x = 0
@@ -64,6 +70,8 @@ const parsePoints = (buffer, count, isGeometryPoint) => {
     return points
   }
 
+  ensureBytes(buffer, count * 16)
+
   if (isGeometryPoint) {
     // GEOMETRY POINT (s2.1.6): x then y.
     for (let i = 1; i <= count; i++) {
@@ -101,6 +109,8 @@ const parseZ = (buffer, points) => {
     return
   }
 
+  ensureBytes(buffer, points.length * 8)
+
   points.forEach(point => {
     point.z = buffer.readDoubleLE(buffer.position)
     buffer.position += 8
@@ -114,6 +124,8 @@ const parseM = (buffer, points) => {
     return
   }
 
+  ensureBytes(buffer, points.length * 8)
+
   points.forEach(point => {
     point.m = buffer.readDoubleLE(buffer.position)
     buffer.position += 8
@@ -139,6 +151,8 @@ const parseFigures = (buffer, count, properties) => {
       pointOffset: 0
     })
   } else {
+    ensureBytes(buffer, count * 5)
+
     for (let i = 1; i <= count; i++) {
       figures.push({
         attribute: buffer.readUInt8(buffer.position),
@@ -173,6 +187,8 @@ const parseShapes = (buffer, count, properties) => {
       type: 0x02
     })
   } else {
+    ensureBytes(buffer, count * 9)
+
     for (let i = 1; i <= count; i++) {
       shapes.push({
         parentOffset: buffer.readInt32LE(buffer.position),
@@ -195,6 +211,8 @@ const parseSegments = (buffer, count) => {
     return segments
   }
 
+  ensureBytes(buffer, count)
+
   for (let i = 1; i <= count; i++) {
     segments.push({ type: buffer.readUInt8(buffer.position) })
 
@@ -207,6 +225,8 @@ const parseSegments = (buffer, count) => {
 const parseGeography = (buffer, isUsingGeometryPoints) => {
   // s2.1.1 + s.2.1.2
 
+  ensureBytes(buffer, 6)
+
   const srid = buffer.readInt32LE(0)
   if (srid === -1) {
     return null
@@ -220,9 +240,6 @@ const parseGeography = (buffer, isUsingGeometryPoints) => {
   const flags = buffer.readUInt8(5)
   buffer.position = 6
 
-  // console.log("srid", srid)
-  // console.log("version", version)
-
   const properties = {
     Z: (flags & (1 << 0)) > 0,
     M: (flags & (1 << 1)) > 0,
@@ -232,23 +249,20 @@ const parseGeography = (buffer, isUsingGeometryPoints) => {
   }
 
   if (value.version === 2) {
-    properties.H = (flags & (1 << 3)) > 0
+    properties.H = (flags & (1 << 5)) > 0
   }
 
-  // console.log("properties", properties);
-
   let numberOfPoints
   if (properties.P) {
     numberOfPoints = 1
   } else if (properties.L) {
     numberOfPoints = 2
   } else {
+    ensureBytes(buffer, 4)
     numberOfPoints = buffer.readUInt32LE(buffer.position)
     buffer.position += 4
   }
 
-  // console.log("numberOfPoints", numberOfPoints)
-
   value.points = parsePoints(buffer, numberOfPoints, isUsingGeometryPoints)
 
   if (properties.Z) {
@@ -259,49 +273,37 @@ const parseGeography = (buffer, isUsingGeometryPoints) => {
     parseM(buffer, value.points)
   }
 
-  // console.log("points", points)
-
   let numberOfFigures
   if (properties.P) {
     numberOfFigures = 1
   } else if (properties.L) {
     numberOfFigures = 1
   } else {
+    ensureBytes(buffer, 4)
     numberOfFigures = buffer.readUInt32LE(buffer.position)
     buffer.position += 4
   }
 
-  // console.log("numberOfFigures", numberOfFigures)
-
   value.figures = parseFigures(buffer, numberOfFigures, properties)
 
-  // console.log("figures", figures)
-
   let numberOfShapes
   if (properties.P) {
     numberOfShapes = 1
   } else if (properties.L) {
     numberOfShapes = 1
   } else {
+    ensureBytes(buffer, 4)
     numberOfShapes = buffer.readUInt32LE(buffer.position)
     buffer.position += 4
   }
 
-  // console.log("numberOfShapes", numberOfShapes)
-
   value.shapes = parseShapes(buffer, numberOfShapes, properties)
 
-  // console.log( "shapes", shapes)
-
-  if (value.version === 2 && buffer.position < buffer.length) {
+  if (value.version === 2 && buffer.position + 4 <= buffer.length) {
     const numberOfSegments = buffer.readUInt32LE(buffer.position)
     buffer.position += 4
 
-    // console.log("numberOfSegments", numberOfSegments)
-
     value.segments = parseSegments(buffer, numberOfSegments)
-
-    // console.log("segments", segments)
   } else {
     value.segments = []
   }