Change the blah_blah_blah_md_header `index_length` member from

`uint64_t` to `size_t` because it describes the size of an in-core
structure as well as an on-disk one, and `size_t` is wide enough
to store the size of any in-core structure, while `uint64_t` may
be much too wide.  Check that `index_length` is no more than SIZE_MAX
after we read it.

1 files changed, 7 insertions, 1 deletions

diff --git a/src/H5FDvfd_swmr.c b/src/H5FDvfd_swmr.c
index c804fb7..3fa172d 100644
--- a/src/H5FDvfd_swmr.c
+++ b/src/H5FDvfd_swmr.c
@@ -1294,6 +1294,7 @@ H5FD__vfd_swmr_header_deserialize(H5FD_t *_file,
         H5FD_VFD_SWMR_MD_HEADER_RETRY_MAX; 
     uint8_t *p = NULL;                      /* Pointer to buffer */
     herr_t ret_value = SUCCEED;             /* Return value */
+    uint64_t index_length;
 
     FUNC_ENTER_STATIC
 
@@ -1364,7 +1365,12 @@ H5FD__vfd_swmr_header_deserialize(H5FD_t *_file,
     UINT32DECODE(p, md_header->fs_page_size);
     UINT64DECODE(p, md_header->tick_num);
     UINT64DECODE(p, md_header->index_offset);
-    UINT64DECODE(p, md_header->index_length);
+    if ((index_length = uint64_decode(&p)) > SIZE_MAX) {
+        HGOTO_ERROR(H5E_VFL, H5E_BADVALUE, FAIL,
+                     "index is too large to hold in core");
+    }
+
+    md_header->index_length = (size_t)index_length;
 
     /* Checksum is already valid */
     UINT32DECODE(p, stored_chksum);