From e36cc2f4bbb547fe2bb2edfb8b019433633a055b Mon Sep 17 00:00:00 2001
From: Nicklas Larsson <n_larsson@yahoo.com>
Date: Sun, 4 Oct 2026 19:38:09 +0200
Subject: [PATCH 1/2] grass/raster: guard compressed row memcpy size

Addresses CID 1687668 introduced by 6e39994ed822ca88e36dc49bd9de15556c3d8efd
---
 lib/raster/get_row.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/lib/raster/get_row.c b/lib/raster/get_row.c
index 84ea8b909d8..6540f64920e 100644
--- a/lib/raster/get_row.c
+++ b/lib/raster/get_row.c
@@ -171,7 +171,7 @@ static void read_data_compressed(int fd, int row, unsigned char *data_buf,
 
     /* Now decompress the row */
     if (fcb->cellhd.compressed > 0) {
-        if (readamount == 0) {
+        if (readamount < 1) {
             G_free(cmp2);
             G_fatal_error(_("Error reading raster data for row %d of <%s>"),
                           row, fcb->name);
@@ -179,14 +179,14 @@ static void read_data_compressed(int fd, int row, unsigned char *data_buf,
 
         /* one byte is nbyte count */
         n = *nbytes = *cmp++;
-        readamount--;
+        readamount -= 1;
     }
     else
         /* pre 3.0 compression */
         n = *nbytes = fcb->nbytes;
 
     bufsize = (size_t)n * fcb->cellhd.cols;
-    if (fcb->cellhd.compressed < 0 || (size_t)readamount < bufsize) {
+    if (fcb->cellhd.compressed < 0 || readamount < bufsize) {
         if (fcb->cellhd.compressed == 1)
             rle_decompress(data_buf, cmp, n, readamount);
         else {
@@ -203,8 +203,13 @@ static void read_data_compressed(int fd, int row, unsigned char *data_buf,
             }
         }
     }
-    else
-        memcpy(data_buf, cmp, readamount);
+    else {
+        if (readamount > bufsize)
+            G_fatal_error(_("Raster row for <%s> is larger than expected"),
+                          fcb->name);
+
+        memcpy(data_buf, cmp, bufsize);
+    }
 
     G_free(cmp2);
 }

From 80592758a427c608d9895871f8aaa586ee5b901a Mon Sep 17 00:00:00 2001
From: Nicklas Larsson <n_larsson@yahoo.com>
Date: Sun, 4 Oct 2026 22:38:04 +0200
Subject: [PATCH 2/2] check 'n > fcb->nbytes', according to review suggestion

The per-cell byte count is read from the file and must not exceed
the bytes-per-cell the data buffer was allocated for (fcb->nbytes
from the map header); a larger value indicates a corrupted file and
would otherwise overflow data_buf below.
---
 lib/raster/get_row.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/raster/get_row.c b/lib/raster/get_row.c
index 6540f64920e..6f23fb4fa89 100644
--- a/lib/raster/get_row.c
+++ b/lib/raster/get_row.c
@@ -180,6 +180,13 @@ static void read_data_compressed(int fd, int row, unsigned char *data_buf,
         /* one byte is nbyte count */
         n = *nbytes = *cmp++;
         readamount -= 1;
+
+        if (n > fcb->nbytes) {
+            G_free(cmp2);
+            G_fatal_error(
+                _("Invalid byte count in raster data for row %d of <%s>"), row,
+                fcb->name);
+        }
     }
     else
         /* pre 3.0 compression */