@@ -2737,7 +2737,11 @@ public function decodePoint(string $wkb): array
27372737 $ format = $ littleEndian ? 'd2 ' : 'd2 ' ; // little-endian doubles
27382738 $ coords = unpack ($ format , $ coordsBin );
27392739
2740- return [$ coords [1 ], $ coords [2 ]];
2740+ if ($ coords === false || !isset ($ coords [1 ], $ coords [2 ])) {
2741+ throw new DatabaseException ('Invalid WKB for POINT: cannot unpack coordinates ' );
2742+ }
2743+
2744+ return [(float )$ coords [1 ], (float )$ coords [2 ]];
27412745 }
27422746
27432747 public function decodeLinestring (string $ wkb ): array
@@ -2758,14 +2762,24 @@ public function decodeLinestring(string $wkb): array
27582762 $ offset = 9 ;
27592763
27602764 // Number of points (4 bytes little-endian)
2761- $ numPoints = unpack ('V ' , substr ($ wkb , $ offset , 4 ))[1 ];
2765+ $ numPointsArr = unpack ('V ' , substr ($ wkb , $ offset , 4 ));
2766+ if ($ numPointsArr === false || !isset ($ numPointsArr [1 ])) {
2767+ throw new DatabaseException ('Invalid WKB: cannot unpack number of points ' );
2768+ }
2769+
2770+ $ numPoints = $ numPointsArr [1 ];
27622771 $ offset += 4 ;
27632772
27642773 $ points = [];
27652774 for ($ i = 0 ; $ i < $ numPoints ; $ i ++) {
2766- $ x = unpack ('d ' , substr ($ wkb , $ offset , 8 ))[1 ];
2767- $ y = unpack ('d ' , substr ($ wkb , $ offset + 8 , 8 ))[1 ];
2768- $ points [] = [(float )$ x , (float )$ y ];
2775+ $ xArr = unpack ('d ' , substr ($ wkb , $ offset , 8 ));
2776+ $ yArr = unpack ('d ' , substr ($ wkb , $ offset + 8 , 8 ));
2777+
2778+ if ($ xArr === false || !isset ($ xArr [1 ]) || $ yArr === false || !isset ($ yArr [1 ])) {
2779+ throw new DatabaseException ('Invalid WKB: cannot unpack point coordinates ' );
2780+ }
2781+
2782+ $ points [] = [(float )$ xArr [1 ], (float )$ yArr [1 ]];
27692783 $ offset += 16 ;
27702784 }
27712785
@@ -2811,7 +2825,12 @@ public function decodePolygon(string $wkb): array
28112825 }
28122826 $ offset += 1 ;
28132827
2814- $ type = unpack ('V ' , substr ($ wkb , $ offset , 4 ))[1 ];
2828+ $ typeArr = unpack ('V ' , substr ($ wkb , $ offset , 4 ));
2829+ if ($ typeArr === false || !isset ($ typeArr [1 ])) {
2830+ throw new DatabaseException ('Invalid WKB: cannot unpack geometry type ' );
2831+ }
2832+
2833+ $ type = $ typeArr [1 ];
28152834 $ hasSRID = ($ type & 0x20000000 ) === 0x20000000 ;
28162835 $ geomType = $ type & 0xFF ;
28172836 $ offset += 4 ;
@@ -2825,27 +2844,43 @@ public function decodePolygon(string $wkb): array
28252844 $ offset += 4 ;
28262845 }
28272846
2828- $ numRings = unpack ('V ' , substr ($ wkb , $ offset , 4 ))[1 ];
2847+ $ numRingsArr = unpack ('V ' , substr ($ wkb , $ offset , 4 ));
2848+
2849+ if ($ numRingsArr === false || !isset ($ numRingsArr [1 ])) {
2850+ throw new DatabaseException ('Invalid WKB: cannot unpack number of rings ' );
2851+ }
2852+
2853+ $ numRings = $ numRingsArr [1 ];
28292854 $ offset += 4 ;
28302855
28312856 $ rings = [];
28322857
28332858 for ($ r = 0 ; $ r < $ numRings ; $ r ++) {
2834- $ numPoints = unpack ('V ' , substr ($ wkb , $ offset , 4 ))[1 ];
2859+ $ numPointsArr = unpack ('V ' , substr ($ wkb , $ offset , 4 ));
2860+
2861+ if ($ numPointsArr === false || !isset ($ numPointsArr [1 ])) {
2862+ throw new DatabaseException ('Invalid WKB: cannot unpack number of points ' );
2863+ }
2864+
2865+ $ numPoints = $ numPointsArr [1 ];
28352866 $ offset += 4 ;
28362867 $ ring = [];
28372868
28382869 for ($ p = 0 ; $ p < $ numPoints ; $ p ++) {
2839- $ x = unpack ('d ' , substr ($ wkb , $ offset , 8 ))[1 ];
2840- $ y = unpack ('d ' , substr ($ wkb , $ offset + 8 , 8 ))[1 ];
2841- $ ring [] = [(float )$ x , (float )$ y ];
2870+ $ xArr = unpack ('d ' , substr ($ wkb , $ offset , 8 ));
2871+ $ yArr = unpack ('d ' , substr ($ wkb , $ offset + 8 , 8 ));
2872+
2873+ if ($ xArr === false || $ yArr === false || !isset ($ xArr [1 ], $ yArr [1 ])) {
2874+ throw new DatabaseException ('Invalid WKB: cannot unpack point coordinates ' );
2875+ }
2876+
2877+ $ ring [] = [(float )$ xArr [1 ], (float )$ yArr [1 ]];
28422878 $ offset += 16 ;
28432879 }
28442880
28452881 $ rings [] = $ ring ;
28462882 }
28472883
28482884 return $ rings ;
2849-
28502885 }
28512886}
0 commit comments