diff options
author | jhendersonHDF <jhenderson@hdfgroup.org> | 2023-04-15 02:02:10 (GMT) |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-04-15 02:02:10 (GMT) |
commit | 4dfa4443a15423f6c483b9c1b46c34fa34efc5e1 (patch) | |
tree | 3e93df7c18142b5f824bd4c1ccf61dd9a268d7e4 /src | |
parent | 6ac41d8415a87e7d248b99cadb6b0dbe63567557 (diff) | |
download | hdf5-4dfa4443a15423f6c483b9c1b46c34fa34efc5e1.zip hdf5-4dfa4443a15423f6c483b9c1b46c34fa34efc5e1.tar.gz hdf5-4dfa4443a15423f6c483b9c1b46c34fa34efc5e1.tar.bz2 |
Fix a heap buffer overflow during H5D__compact_readvv (GitHub #2606) (#2664) (#2727)
Diffstat (limited to 'src')
-rw-r--r-- | src/H5Dint.c | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/src/H5Dint.c b/src/H5Dint.c index ace3d07..3d5d067 100644 --- a/src/H5Dint.c +++ b/src/H5Dint.c @@ -1696,6 +1696,33 @@ H5D__open_oid(H5D_t *dataset, hid_t dapl_id) /* Indicate that the layout information was initialized */ layout_init = TRUE; + /* + * Now that we've read the dataset's datatype, dataspace and + * layout information, perform a quick check for compact datasets + * to ensure that the size of the internal buffer that was + * allocated for the dataset's raw data matches the size of + * the data. A corrupted file can cause a mismatch between the + * two, which might result in buffer overflows during future + * I/O to the dataset. + */ + if (H5D_COMPACT == dataset->shared->layout.type) { + hssize_t dset_nelemts = 0; + size_t dset_type_size = H5T_GET_SIZE(dataset->shared->type); + size_t dset_data_size = 0; + + HDassert(H5D_COMPACT == dataset->shared->layout.storage.type); + + if ((dset_nelemts = H5S_GET_EXTENT_NPOINTS(dataset->shared->space)) < 0) + HGOTO_ERROR(H5E_DATASET, H5E_CANTGET, FAIL, "can't get number of elements in dataset's dataspace") + + dset_data_size = (size_t)dset_nelemts * dset_type_size; + + if (dataset->shared->layout.storage.u.compact.size != dset_data_size) + HGOTO_ERROR(H5E_DATASET, H5E_BADVALUE, FAIL, + "bad value from dataset header - size of compact dataset's data buffer doesn't match " + "size of dataset data"); + } + /* Set up flush append property */ if (H5D__append_flush_setup(dataset, dapl_id)) HGOTO_ERROR(H5E_DATASET, H5E_CANTSET, FAIL, "unable to set up flush append property") |