From 68ccd2370c105ba1da04e90dbbb5e06f5c52736d Mon Sep 17 00:00:00 2001 From: Esteban Zimanyi Date: Wed, 29 Jul 2026 07:46:22 +0200 Subject: [PATCH] Copy hex-WKB input to a NUL-terminated buffer before stbox_from_hexwkb string_t::GetData() is not NUL-terminated, but stbox_from_hexwkb() strlen()s its argument, so passing the raw pointer can overrun the buffer on allocators that leave the trailing byte non-zero (macOS arm64), producing a spurious 'Invalid hex string' error. Copy into a std::string first, matching the other hex-WKB consumers. --- src/geo/stbox_functions.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/geo/stbox_functions.cpp b/src/geo/stbox_functions.cpp index b76f19e3..4e53f26e 100644 --- a/src/geo/stbox_functions.cpp +++ b/src/geo/stbox_functions.cpp @@ -191,8 +191,12 @@ void StboxFunctions::Stbox_from_hexwkb(DataChunk &args, ExpressionState &state, UnaryExecutor::Execute( args.data[0], result, args.size(), [&](string_t input_hexwkb) -> string_t { - char *hexwkb = (char*)input_hexwkb.GetData(); - STBox *stbox = stbox_from_hexwkb(hexwkb); + // string_t::GetData() is not NUL-terminated, but stbox_from_hexwkb() + // strlen()s its argument; reading the raw pointer overruns the buffer + // on allocators that leave the trailing byte non-zero (e.g. macOS arm64). + // Copy into a NUL-terminated std::string first, as the sibling consumers do. + std::string hexwkb = input_hexwkb.GetString(); + STBox *stbox = stbox_from_hexwkb(hexwkb.c_str()); if (!stbox) { throw InternalException("Failure in Stbox_from_hexwkb: unable to cast hexwkb to stbox"); return string_t();