Skip to content

fix: prevent StackOverflowError from deeply nested GeometryCollection in GeoJsonParser#1699

Open
ZeroX-404 wants to merge 1 commit into
googlemaps:mainfrom
ZeroX-404:fix/geojson-stack-overflow
Open

fix: prevent StackOverflowError from deeply nested GeometryCollection in GeoJsonParser#1699
ZeroX-404 wants to merge 1 commit into
googlemaps:mainfrom
ZeroX-404:fix/geojson-stack-overflow

Conversation

@ZeroX-404
Copy link
Copy Markdown

Description:

## Problem
`GeoJsonParser.parseGeometry()` and `createGeometryCollection()` call each 
other recursively with no depth limit. A malicious GeoJSON file containing 
deeply nested `GeometryCollection` objects triggers a `StackOverflowError`, 
crashing any Android app that loads the file via `GeoJsonLayer`.

**Vulnerable call chain:**

parseGeometry()
→ createGeometry()
→ createGeometryCollection()
→ parseGeometry() // unbounded recursion


A PoC GeoJSON file of ~93KB with 2000 levels of nesting is sufficient 
to trigger the crash.

## Fix
- Add `MAX_GEOMETRY_DEPTH = 20` constant
- Add private `parseGeometry(JSONObject, int depth)` overload
- Pass depth counter through `createGeometry()` and `createGeometryCollection()`
- Geometries exceeding the limit are ignored with a `Log.w()` warning

## Testing
Verified that parsing a GeoJSON with 2000 nesting levels no longer 
throws `StackOverflowError` after this fix.

Add MAX_GEOMETRY_DEPTH = 20 limit to parseGeometry() to prevent
StackOverflowError when parsing malicious GeoJSON with deeply nested
GeometryCollection objects.

Geometries exceeding the depth limit are silently ignored and a
warning is logged via Log.w().
@google-cla
Copy link
Copy Markdown

google-cla Bot commented Jun 7, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants