From 5ac4f17d3d7d54256309d20c4cb2d89363c9ac88 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 30 Jul 2026 11:48:44 +1000 Subject: [PATCH] MDEV-40552 UBSAN: not a valid value for wkbByteOrder Gis_multi_point The byteorder field could contain an invalid value (> 1) on a GIS multi_point object where there byteorder was on any of the inner points. This can occur with any of the GIS "*FromWKB" functions that contained a multipoint object. This result in a invalid object being accepted and also potentially trigger undefined behaviour in the processing of the object. --- mysql-test/main/gis.result | 9 +++++++++ mysql-test/main/gis.test | 7 +++++++ sql/spatial.cc | 2 ++ 3 files changed, 18 insertions(+) diff --git a/mysql-test/main/gis.result b/mysql-test/main/gis.result index 0fe92b2f50c13..d60f8da2d5d51 100644 --- a/mysql-test/main/gis.result +++ b/mysql-test/main/gis.result @@ -5644,4 +5644,13 @@ NULL SELECT ST_GEOMFROMWKB (0x01050000000100000082040000000100000000000000000000000000000000000000) as g; g NULL +# +# MDEV-40552 UBSAN : load of value X, which is not a valid value for type 'wkbByteOrder' Gis_multi_point::init_from_wkb +# +SELECT ST_GEOMFROMWKB (0x0104000000010000000201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo; +multipoint_bad_inner_bo +NULL +SELECT ST_GEOMFROMWKB (0x0104000000010000008201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo; +multipoint_bad_inner_bo +NULL # End of 10.11 tests diff --git a/mysql-test/main/gis.test b/mysql-test/main/gis.test index 609c1509396f5..1efed8d076903 100644 --- a/mysql-test/main/gis.test +++ b/mysql-test/main/gis.test @@ -3605,4 +3605,11 @@ SELECT ST_GEOMFROMWKB (0x01070000000100000082010000000000000000000000) as g; SELECT ST_GEOMFROMWKB (0x01050000000100000002040000000100000000000000000000000000000000000000) as g; SELECT ST_GEOMFROMWKB (0x01050000000100000082040000000100000000000000000000000000000000000000) as g; +--echo # +--echo # MDEV-40552 UBSAN : load of value X, which is not a valid value for type 'wkbByteOrder' Gis_multi_point::init_from_wkb +--echo # + +SELECT ST_GEOMFROMWKB (0x0104000000010000000201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo; +SELECT ST_GEOMFROMWKB (0x0104000000010000008201000000000000000000000000000000000000000000000000) as multipoint_bad_inner_bo; + --echo # End of 10.11 tests diff --git a/sql/spatial.cc b/sql/spatial.cc index 2de3c57ef1a11..979bac0954533 100644 --- a/sql/spatial.cc +++ b/sql/spatial.cc @@ -2180,6 +2180,8 @@ uint Gis_multi_point::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo, { res->q_append((char)wkb_ndr); res->q_append((uint32)wkb_point); + if ((uchar) wkb[0] > wkb_ndr) /* invalid */ + return 0; if (!p.init_from_wkb(wkb + WKB_HEADER_SIZE, POINT_DATA_SIZE, (wkbByteOrder) wkb[0], res)) return 0;