geos: avoid division by zero

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14602
Credit to OSS Fuzz

6 files changed, 26 insertions, 8 deletions

diff --git a/src/apps/gie.cpp b/src/apps/gie.cpp
index 5a86ebb7..2f401984 100644
--- a/src/apps/gie.cpp
+++ b/src/apps/gie.cpp
@@ -1121,7 +1121,7 @@ static const struct errno_vs_err_const lookup[] = {
     {"pjd_err_w_or_m_zero_or_less"      ,  -27},
     {"pjd_err_lsat_not_in_range"        ,  -28},
     {"pjd_err_path_not_in_range"        ,  -29},
-    {"pjd_err_h_less_than_zero"         ,  -30},
+    {"pjd_err_invalid_h"                ,  -30},
     {"pjd_err_k_less_than_zero"         ,  -31},
     {"pjd_err_lat_1_or_2_zero_or_90"    ,  -32},
     {"pjd_err_lat_0_or_alpha_eq_90"     ,  -33},
diff --git a/src/proj_internal.h b/src/proj_internal.h
index 66cadb1a..8c365793 100644
--- a/src/proj_internal.h
+++ b/src/proj_internal.h
@@ -648,7 +648,7 @@ struct FACTORS {
 #define PJD_ERR_W_OR_M_ZERO_OR_LESS     -27
 #define PJD_ERR_LSAT_NOT_IN_RANGE       -28
 #define PJD_ERR_PATH_NOT_IN_RANGE       -29
-#define PJD_ERR_H_LESS_THAN_ZERO        -30
+#define PJD_ERR_INVALID_H               -30
 #define PJD_ERR_K_LESS_THAN_ZERO        -31
 #define PJD_ERR_LAT_1_OR_2_ZERO_OR_90   -32
 #define PJD_ERR_LAT_0_OR_ALPHA_EQ_90    -33
diff --git a/src/projections/geos.cpp b/src/projections/geos.cpp
index 7c15f22a..5b3e594c 100644
--- a/src/projections/geos.cpp
+++ b/src/projections/geos.cpp
@@ -202,8 +202,7 @@ PJ *PROJECTION(geos) {
         return pj_default_destructor (P, ENOMEM);
     P->opaque = Q;
 
-    if ((Q->h = pj_param(P->ctx, P->params, "dh").f) <= 0.)
-        return pj_default_destructor (P, PJD_ERR_H_LESS_THAN_ZERO);
+    Q->h = pj_param(P->ctx, P->params, "dh").f;
 
     sweep_axis = pj_param(P->ctx, P->params, "ssweep").s;
     if (sweep_axis == nullptr)
@@ -220,6 +219,8 @@ PJ *PROJECTION(geos) {
     }
 
     Q->radius_g_1 = Q->h / P->a;
+    if ( Q->radius_g_1 <= 0 || Q->radius_g_1 > 1e10 )
+        return pj_default_destructor (P, PJD_ERR_INVALID_H);
     Q->radius_g = 1. + Q->radius_g_1;
     Q->C  = Q->radius_g * Q->radius_g - 1.0;
     if (P->es != 0.0) {
diff --git a/src/projections/nsper.cpp b/src/projections/nsper.cpp
index fbf5317b..d641e1b6 100644
--- a/src/projections/nsper.cpp
+++ b/src/projections/nsper.cpp
@@ -148,8 +148,7 @@ static PJ_LP nsper_s_inverse (PJ_XY xy, PJ *P) {           /* Spheroidal, invers
 static PJ *setup(PJ *P) {
     struct pj_opaque *Q = static_cast<struct pj_opaque*>(P->opaque);
 
-    if ((Q->height = pj_param(P->ctx, P->params, "dh").f) <= 0.)
-        return pj_default_destructor(P, PJD_ERR_H_LESS_THAN_ZERO);
+    Q->height = pj_param(P->ctx, P->params, "dh").f;
 
     if (fabs(fabs(P->phi0) - M_HALFPI) < EPS10)
         Q->mode = P->phi0 < 0. ? S_POLE : N_POLE;
@@ -161,6 +160,8 @@ static PJ *setup(PJ *P) {
         Q->cosph0 = cos(P->phi0);
     }
     Q->pn1 = Q->height / P->a; /* normalize by radius */
+    if ( Q->pn1 <= 0 || Q->pn1 > 1e10 )
+        return pj_default_destructor (P, PJD_ERR_INVALID_H);
     Q->p = 1. + Q->pn1;
     Q->rp = 1. / Q->p;
     Q->h = 1. / Q->pn1;
diff --git a/src/strerrno.cpp b/src/strerrno.cpp
index c230d226..12546bd0 100644
--- a/src/strerrno.cpp
+++ b/src/strerrno.cpp
@@ -39,7 +39,7 @@ pj_err_list[] = {
     "W <= 0 or M <= 0",                                                /* -27 */
     "lsat not in 1-5 range",                                           /* -28 */
     "path not in range",                                               /* -29 */
-    "h <= 0",                                                          /* -30 */
+    "h <= 0 or h > 1e10 * a",                                          /* -30 */
     "k <= 0",                                                          /* -31 */
     "lat_1=lat_2 or lat_1=0 or lat_2=90",                              /* -32 */
     "lat_0 = 0 or 90 or alpha = 90",                                   /* -33 */
diff --git a/test/gie/builtins.gie b/test/gie/builtins.gie
index ba9fc0aa..df19efb6 100644
--- a/test/gie/builtins.gie
+++ b/test/gie/builtins.gie
@@ -1624,6 +1624,17 @@ expect  -0.001790493 0.000895247
 accept  -200 -100
 expect  -0.001790493 -0.000895247
 
+-------------------------------------------------------------------------------
+operation +proj=geos +R=1 +h=0
+-------------------------------------------------------------------------------
+expect  failure errno invalid_h
+
+-------------------------------------------------------------------------------
+operation +proj=geos +R=1 +h=1e11
+-------------------------------------------------------------------------------
+expect  failure errno invalid_h
+
+
 
 ===============================================================================
 Ginsburg VIII (TsNIIGAiK)
@@ -3729,7 +3740,12 @@ roundtrip   100
 -------------------------------------------------------------------------------
 operation +proj=nsper +R=1 +h=0
 -------------------------------------------------------------------------------
-expect  failure errno h_less_than_zero
+expect  failure errno invalid_h
+
+-------------------------------------------------------------------------------
+operation +proj=nsper +R=1 +h=1e11
+-------------------------------------------------------------------------------
+expect  failure errno invalid_h
 
 
 ===============================================================================