MiraMonVector: Fix unsigned integer overflows (ossfuzz#68585) (OSGeo#…

…9841) Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68585
rouault · May 3, 2024 · b254210 · b254210
1 parent 0c3c9f7
commit b254210
Showing 1 changed file with 26 additions and 0 deletions.
diff --git a/ogr/ogrsf_frmts/miramon/mm_rdlayr.c b/ogr/ogrsf_frmts/miramon/mm_rdlayr.c
@@ -449,6 +449,23 @@ MMGetMultiPolygonCoordinates(struct MiraMonVectLayerInfo *hMiraMonLayer,
 
         pArcHeader = hMiraMonLayer->MMPolygon.MMArc.pArcHeader +
                      (hMiraMonLayer->pArcs + nIndex)->nIArc;
+
+        if (hMiraMonLayer->ReadFeature
+                .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] >
+            UINT64_MAX - pArcHeader->nElemCount)
+        {
+            free_function(pBuffer);
+            return 1;
+        }
+
+        if (hMiraMonLayer->ReadFeature
+                .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] >
+            UINT64_MAX - pArcHeader->nElemCount)
+        {
+            free_function(pBuffer);
+            return 1;
+        }
+
         hMiraMonLayer->ReadFeature
             .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] +=
             pArcHeader->nElemCount;
@@ -517,10 +534,19 @@ MMGetMultiPolygonCoordinates(struct MiraMonVectLayerInfo *hMiraMonLayer,
             return 1;
         }
 
+        if (hMiraMonLayer->ReadFeature
+                .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] >
+            UINT64_MAX - hMiraMonLayer->ReadFeature.nNumpCoord)
+        {
+            free_function(pBuffer);
+            return 1;
+        }
+
         hMiraMonLayer->ReadFeature
             .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] +=
             hMiraMonLayer->ReadFeature.nNumpCoord;
         nNAcumulVertices += hMiraMonLayer->ReadFeature.nNumpCoord;
+
         if ((hMiraMonLayer->pArcs + nIndex)->VFG & MM_POL_END_RING)
         {
             hMiraMonLayer->ReadFeature