diff options
author | Larry Knox <lrknox@hdfgroup.org> | 2023-08-04 19:17:33 (GMT) |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-08-04 19:17:33 (GMT) |
commit | 3262891c6b2060cb8044e37cab461275d7ac4a58 (patch) | |
tree | 253bd5c4d73458a035997329b91abc76e3d31a14 /src/H5HLcache.c | |
parent | 1bb9a0d45ce31eb1cdffd1b79d975afeab34851c (diff) | |
download | hdf5-3262891c6b2060cb8044e37cab461275d7ac4a58.zip hdf5-3262891c6b2060cb8044e37cab461275d7ac4a58.tar.gz hdf5-3262891c6b2060cb8044e37cab461275d7ac4a58.tar.bz2 |
Merges from develop Aug 2-4 (#3354)
* Fix CVE-2018-11202 (#3330)
A malformed file could result in chunk index memory leaks. Under most
conditions (i.e., when the --enable-using-memchecker option is NOT
used), this would result in a small memory leak and and infinite loop
and abort when shutting down the library. The infinite loop would be
due to the "free list" package not being able to clear its resources
so the library couldn't shut down. When the "using a memory checker"
option is used, the free lists are disabled so there is just a memory
leak with no abort on library shutdown.
The chunk index resources are now correctly cleaned up when reading
misparsed files and valgrind confirms no memory leaks.
* Fix CVE-2018-13867 (#3336)
* Windows runtime items go into the bin folder (#3320)
Diffstat (limited to 'src/H5HLcache.c')
-rw-r--r-- | src/H5HLcache.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/H5HLcache.c b/src/H5HLcache.c index 653590d..377bc0f 100644 --- a/src/H5HLcache.c +++ b/src/H5HLcache.c @@ -194,6 +194,12 @@ H5HL__hdr_deserialize(H5HL_t *heap, const uint8_t *image, size_t len, H5HL_cache HGOTO_ERROR(H5E_HEAP, H5E_OVERFLOW, FAIL, "ran off end of input buffer while decoding"); H5F_addr_decode_len(udata->sizeof_addr, &image, &(heap->dblk_addr)); + /* Check that the datablock address is valid (might not be true + * in a corrupt file) + */ + if (!H5_addr_defined(heap->dblk_addr)) + HGOTO_ERROR(H5E_HEAP, H5E_BADVALUE, FAIL, "bad datablock address"); + done: FUNC_LEAVE_NOAPI(ret_value) } /* end H5HL__hdr_deserialize() */ |