Slashdot Mirror

http://postgis.refractions.net/ - pretty good spatial functions based on top of PostgreSQL, and not tied to Oracle.

There are many, many open source GIS packages that you might find useful rather than implementing everything yourself. http://maptools.org/ is one place to get some pointers from.

Actually, I personally found and patched the TIFF bug. In January. Of last year. http://bugzilla.maptools.org/show_bug.cgi?id=1985
Feeding random data (aka fuzzing) might work, but 99% of the time, I'd imagine it'd just give you a corrupted image and bail out. You have to be clever about how you search for it. I found a known vulnerability patch posted by, of all people, an Apple employee, and tried to reverse engineer what he'd fixed. I found that the patch hadn't been applied on old version of the PSP system software, which is what I was targeting. After messing with this specific attack vector, I noticed that I could still crash system software version that did have the patch. After reading up on LZW compression (which is what part of LibTIFF had the vulnerability) and the TIFF specification of how they implemented LZW, I realized that the Apple patch was incomplete--it only tested for one value you could give it that was erroneous. By simply changing the equality they used (in two places) to an inequality, I tested for all erroneous values. Meanwhile, I tried to exploit the new unpatched vector on the PSP so that I could inject code. Failing this, I decided the best course of action was to submit a bug report to LibTIFF. It might seem a tad unethical to try and exploit the bug before reporting it, but I wasn't trying to exploit in for malicious purposes, and not on a desktop operating system. Regardless, I failed to make it do more than crash the PSP. Surely the best course of action here would be to patch it upstream before anyone else found it. (Incidentally, this "arbitrary execution" this is blown out of proportion. In its current state, it is extremely unlikely that it could provide ANY code execution. Just crashing. Although I don't know if it's IMPOSSIBLE for it to execute code with this vulnerability, it would take a lot of work to get anything valuable out of this. Mostly it's a DoS. They usually just attach "arbitrary execution" when there's even the vaguest possibility for code to be executed, regardless of whether or not such an exploit has been demonstrated.)

It, um, took a while for anyone to notice the patch. In fact, the only reason anyone did notice was because someone found some of the fruit of my research into this bug and then posted a link to the research in a new bug report. Funnily, they created a different patch, which, instead of preventing the infinite loop caused by the erroneous data, just tested to see if the loop was writing out of bounds. Perhaps both approaches should be used together. Defensive programming and all that. Regardless, I noticed this new bug report shortly afterward it was posted and pointed them back to the inexplicably ignored old bug report. Most Linux vendors applied the patch shortly after the new bug report was filed, but Apple lagged by a number of months, until 10.6.2 came out. This update backports the fix into 10.5.x. However, I've found that some projects (such as Qt) are still using ancient versions of LibTIFF that have had numerous bug and security fixes since they were last updated in the projects' trees. While Qt does try to use the system's version of Qt if it can, it's still kind of scary to think about what could happen if it falls back on its own version, as I've seen it do before when I try my "corrupted" TIFF on things like Arora.

Incidentally, I am TAing a computer security course this semester. I guess previous experience helps.

Shapefiles use a dbase file along with the shp file. Tons of software can read the dbase file and you have the added feature of storing the UTM locations of the access point and graphing it.

There is a c library called shapelib http://shapelib.maptools.org/ that allows for you to write the files easily. The c code can be compiled and run on vista and almost any other OS.

How about that.
W3rdna

Most of the good stuff is not showcased for some odd reason.

If you want to compare to google start with ka-map at http://ka-map.maptools.org/ but that's not the only interesting things going on.

And realize that with these tools you get to render your own layers, not just lay data over google's background (maybe I'm not totally up on what all you can do with google's API though). Google has changed the web based GIS quite a bit but before them, mapserver was the best FOSS way to do it by far and it's still the way to do stuff where you need real control.

Ka-Map is an interface api based on Mapserver which allows you to create and navigate tiled maps ala Google Maps. Check out a demo site here

It is a fairly young project, just waiting for a few more talented programmers to help push it along. I would love to see a open source alternative to Google Maps and Yahoo Maps providing base maps to these services.

• ka-Map

• http://maps.dmsolutions.ca/

• planet-earth

There is a newly released interface to the mapserver application called Ka-Map that adopts a tiled map approach, similar to Google Maps. Pretty speedy considering maptools.org doesn't have anything close to Googles resources.

Xix.

Xix.

Xix.

Anybody have any software that would take a large image file and apply a google-map-like interface to it?

http://www.atlas.gc.ca

This is built on Chameleon, a GPL frontend for the GPL UMN mapserver whose development were partially funded by Canadian and American governments, respectively, for purely selfish reasons (reducing the costs of producing GIS servers, and being able to provide more information to more groups more cheaply.)

PostGIS kicks butt. I'd recommend for the first time avoiding PostGIS and going right to MapServer which can read TIGER files directly. Then plan to come to the Open Source GIS and MapServer Users Conference, June 9-11 in Ottawa :) -Tyler