diff options
author | David Young <dyoung@hdfgroup.org> | 2020-01-10 17:26:33 (GMT) |
---|---|---|
committer | David Young <dyoung@hdfgroup.org> | 2020-01-10 18:00:22 (GMT) |
commit | 3a911e2b39bb4bf5c06dd4d0a99a847ddd87ce5e (patch) | |
tree | 4fa7bd5412840eb1e823d9280bad4ee5cb937408 /src/H5Ftest.c | |
parent | 1df69ed3a09436575b455b784b35ad52cc74eabe (diff) | |
download | hdf5-3a911e2b39bb4bf5c06dd4d0a99a847ddd87ce5e.zip hdf5-3a911e2b39bb4bf5c06dd4d0a99a847ddd87ce5e.tar.gz hdf5-3a911e2b39bb4bf5c06dd4d0a99a847ddd87ce5e.tar.bz2 |
Change the blah_blah_blah_md_header `index_length` member from
`uint64_t` to `size_t` because it describes the size of an in-core
structure as well as an on-disk one, and `size_t` is wide enough
to store the size of any in-core structure, while `uint64_t` may
be much too wide. Check that `index_length` is no more than SIZE_MAX
after we read it.
Diffstat (limited to 'src/H5Ftest.c')
-rw-r--r-- | src/H5Ftest.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/H5Ftest.c b/src/H5Ftest.c index 90657ef..ed3fec1 100644 --- a/src/H5Ftest.c +++ b/src/H5Ftest.c @@ -349,6 +349,7 @@ done: static herr_t H5F__vfd_swmr_decode_md_hdr(int md_fd, H5FD_vfd_swmr_md_header *md_hdr) { + uint64_t index_length; uint8_t image[H5FD_MD_HEADER_SIZE]; /* Buffer for the header image */ uint8_t *p = NULL; /* Points to the image */ herr_t ret_value = SUCCEED; /* Return value */ @@ -375,7 +376,10 @@ H5F__vfd_swmr_decode_md_hdr(int md_fd, H5FD_vfd_swmr_md_header *md_hdr) UINT32DECODE(p, md_hdr->fs_page_size); UINT64DECODE(p, md_hdr->tick_num); UINT64DECODE(p, md_hdr->index_offset); - UINT64DECODE(p, md_hdr->index_length); + if ((index_length = uint64_decode(&p)) > SIZE_MAX) { + HGOTO_ERROR(H5E_FILE, H5E_BADVALUE, FAIL, "index is too long") + } + md_hdr->index_length = (size_t)index_length; done: FUNC_LEAVE_NOAPI(ret_value) |