diff options
| author | Neil Fortner <nfortne2@hdfgroup.org> | 2012-03-25 03:18:31 (GMT) |
|---|---|---|
| committer | Neil Fortner <nfortne2@hdfgroup.org> | 2012-03-25 03:18:31 (GMT) |
| commit | 1e0306a7c9d0c52228e1544ff9251b3287f8e38e (patch) | |
| tree | 20ab5e8fbaec64ee2144e8faca8853c4a917ba8d | |
| parent | ec04239a6f2b6f217b606e6b2fb92650b2c19731 (diff) | |
| download | hdf5-1e0306a7c9d0c52228e1544ff9251b3287f8e38e.zip hdf5-1e0306a7c9d0c52228e1544ff9251b3287f8e38e.tar.gz hdf5-1e0306a7c9d0c52228e1544ff9251b3287f8e38e.tar.bz2 | |
[svn-r22138] Add check for valid number of children in H5B_decode(). See HDFFV-5897.
Tested: jam, durandal (too minor for full h5committest)
| -rw-r--r-- | src/H5Bcache.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/H5Bcache.c b/src/H5Bcache.c index c0fd121..68fb920 100644 --- a/src/H5Bcache.c +++ b/src/H5Bcache.c @@ -152,6 +152,10 @@ H5B_load(H5F_t *f, hid_t dxpl_id, haddr_t addr, void *_udata) /* entries used */ UINT16DECODE(p, bt->nchildren); + /* Check if bt->nchildren is greater than two_k */ + if(bt->nchildren > shared->two_k) + HGOTO_ERROR(H5E_BTREE, H5E_BADVALUE, NULL, "number of children is greater than maximum") + /* sibling pointers */ H5F_addr_decode(udata->f, (const uint8_t **)&p, &(bt->left)); H5F_addr_decode(udata->f, (const uint8_t **)&p, &(bt->right)); |