summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--hl/src/H5IM.c3
-rw-r--r--hl/tools/gif2h5/hdf2gif.c33
-rw-r--r--release_docs/RELEASE.txt12
-rw-r--r--src/H5.c8
-rw-r--r--src/H5Oattr.c5
-rw-r--r--src/H5private.h29
6 files changed, 73 insertions, 17 deletions
diff --git a/hl/src/H5IM.c b/hl/src/H5IM.c
index 2a7ed9b..6f7414b 100644
--- a/hl/src/H5IM.c
+++ b/hl/src/H5IM.c
@@ -274,7 +274,8 @@ herr_t H5IMget_image_info( hid_t loc_id,
return -1;
/* Try to find the attribute "INTERLACE_MODE" on the >>image<< dataset */
- has_attr = H5LT_find_attribute(did, "INTERLACE_MODE");
+ if ((has_attr = H5LT_find_attribute(did, "INTERLACE_MODE")) < 0)
+ goto out;
/* It exists, get it */
if(has_attr == 1)
diff --git a/hl/tools/gif2h5/hdf2gif.c b/hl/tools/gif2h5/hdf2gif.c
index e32facb..0e2a898 100644
--- a/hl/tools/gif2h5/hdf2gif.c
+++ b/hl/tools/gif2h5/hdf2gif.c
@@ -149,30 +149,41 @@ int main(int argc , char **argv)
goto out;
}
- /* read image */
+ /* get image's information */
if ( H5IMget_image_info( fid, image_name, &width, &height, &planes, interlace, &npals ) < 0 )
+ {
+ fprintf(stderr , "Unable to get information of the image. Aborting.\n");
goto out;
+ }
- if (width > IMAGE_WIDTH_MAX || height > IMAGE_HEIGHT_MAX){
- fprintf(stderr, "HDF5 image is too large. Limit is %d by %d.\n", IMAGE_WIDTH_MAX, IMAGE_HEIGHT_MAX);
- goto out;
- }
+ if (width > IMAGE_WIDTH_MAX || height > IMAGE_HEIGHT_MAX)
+ {
+ fprintf(stderr, "HDF5 image is too large. Limit is %d by %d.\n", IMAGE_WIDTH_MAX, IMAGE_HEIGHT_MAX);
+ goto out;
+ }
- /* tool can handle single plane images only. */
- if (planes > 1){
- fprintf(stderr, "Cannot handle multiple planes image\n");
- goto out;
- }
+ /* tool can handle single plane images only. */
+ if (planes > 1)
+ {
+ fprintf(stderr, "Cannot handle multiple planes image\n");
+ goto out;
+ }
Image = (GIFBYTE*) malloc( (size_t) width * (size_t) height );
if ( H5IMread_image( fid, image_name, Image ) < 0 )
+ {
+ fprintf(stderr , "Unable to read the image. Aborting.\n");
goto out;
+ }
if (npals)
{
if ( H5IMget_palette_info( fid, image_name, 0, pal_dims ) < 0 )
+ {
+ fprintf(stderr , "Unable to get information of the palette. Aborting.\n");
goto out;
+ }
pal = (GIFBYTE*) malloc( (size_t) pal_dims[0] * (size_t) pal_dims[1] );
@@ -246,7 +257,7 @@ int main(int argc , char **argv)
if (j==i)
{
/* wasn't found */
- pc2nc[i] = (GIFBYTE)nc;
+ pc2nc[i] = (GIFBYTE)nc;
r1[nc] = Red[i];
g1[nc] = Green[i];
b1[nc] = Blue[i];
diff --git a/release_docs/RELEASE.txt b/release_docs/RELEASE.txt
index 102402e..72cab28 100644
--- a/release_docs/RELEASE.txt
+++ b/release_docs/RELEASE.txt
@@ -631,6 +631,18 @@ Bug Fixes since HDF5-1.10.3 release
Library
-------
+ - Fixed the decoding of an attribute message to prevent a segfault by h52gif
+
+ The tool h52gif produced a segfault when the size of an attribute
+ message was corrupted and caused a buffer overflow.
+
+ The problem was fixed by verifying the attribute message's size
+ against the buffer size before accessing the buffer. h52gif was
+ also fixed to display the failure instead of silently exiting
+ after the segfault was eliminated.
+
+ (BMR - 2020/6/19, HDFFV-10591)
+
- Improved peformance when creating a large number of small datasets by
retrieving default property values from the API context instead of doing
skip list searches.
diff --git a/src/H5.c b/src/H5.c
index bd78ca2..31b8546 100644
--- a/src/H5.c
+++ b/src/H5.c
@@ -938,11 +938,13 @@ H5open(void)
{
herr_t ret_value=SUCCEED; /* Return value */
- FUNC_ENTER_API_NOCLEAR(FAIL)
- H5TRACE0("e","");
+ FUNC_ENTER_API_NOPUSH(FAIL)
+ /*NO TRACE*/
+
/* all work is done by FUNC_ENTER() */
+
done:
- FUNC_LEAVE_API(ret_value)
+ FUNC_LEAVE_API_NOPUSH(ret_value)
} /* end H5open() */
diff --git a/src/H5Oattr.c b/src/H5Oattr.c
index aeaebea..e38ef5c 100644
--- a/src/H5Oattr.c
+++ b/src/H5Oattr.c
@@ -238,6 +238,11 @@ H5O_attr_decode(H5F_t *f, H5O_t *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
/* Go get the data */
if(attr->shared->data_size) {
+ /* Ensure that data size doesn't exceed buffer size, in case of
+ it's being corrupted in the file */
+ if(attr->shared->data_size > p_size)
+ HGOTO_ERROR(H5E_RESOURCE, H5E_OVERFLOW, NULL, "data size exceeds buffer size")
+
if(NULL == (attr->shared->data = H5FL_BLK_MALLOC(attr_buf, attr->shared->data_size)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
H5MM_memcpy(attr->shared->data, p, attr->shared->data_size);
diff --git a/src/H5private.h b/src/H5private.h
index 2236ee6..aca4851 100644
--- a/src/H5private.h
+++ b/src/H5private.h
@@ -2145,8 +2145,9 @@ H5_DLL herr_t H5CX_pop(void);
} /* end if */ \
\
/* Initialize the package, if appropriate */ \
- H5_PACKAGE_INIT(H5_MY_PKG_INIT, err) \
- \
+ H5_PACKAGE_INIT(H5_MY_PKG_INIT, err)
+
+#define FUNC_ENTER_API_PUSH(err) \
/* Push the name of this function on the function stack */ \
H5_PUSH_FUNC \
\
@@ -2160,6 +2161,7 @@ H5_DLL herr_t H5CX_pop(void);
#define FUNC_ENTER_API(err) {{ \
FUNC_ENTER_API_COMMON \
FUNC_ENTER_API_INIT(err); \
+ FUNC_ENTER_API_PUSH(err); \
/* Clear thread error stack entering public functions */ \
H5E_clear_stack(NULL); \
{
@@ -2171,6 +2173,7 @@ H5_DLL herr_t H5CX_pop(void);
#define FUNC_ENTER_API_NOCLEAR(err) {{ \
FUNC_ENTER_API_COMMON \
FUNC_ENTER_API_INIT(err); \
+ FUNC_ENTER_API_PUSH(err); \
{
/*
@@ -2200,6 +2203,18 @@ H5_DLL herr_t H5CX_pop(void);
BEGIN_MPE_LOG \
{
+/*
+ * Use this macro for API functions that should only perform initialization
+ * of the library or an interface, but not push any state (API context,
+ * function name, start MPE logging, etc) examples are: H5open.
+ *
+ */
+#define FUNC_ENTER_API_NOPUSH(err) {{{{{ \
+ FUNC_ENTER_COMMON(H5_IS_API(FUNC)); \
+ FUNC_ENTER_API_THREADSAFE; \
+ FUNC_ENTER_API_INIT(err); \
+ {
+
/* Note: this macro only works when there's _no_ interface initialization routine for the module */
#define FUNC_ENTER_NOAPI_INIT(err) \
/* Initialize the package, if appropriate */ \
@@ -2389,6 +2404,16 @@ H5_DLL herr_t H5CX_pop(void);
return(ret_value); \
}}}} /*end scope from beginning of FUNC_ENTER*/
+/* Use this macro to match the FUNC_ENTER_API_NOPUSH macro */
+#define FUNC_LEAVE_API_NOPUSH(ret_value) \
+ ; \
+ } /*end scope from end of FUNC_ENTER*/ \
+ if(err_occurred) \
+ (void)H5E_dump_api_stack(TRUE); \
+ FUNC_LEAVE_API_THREADSAFE \
+ return(ret_value); \
+}}}}} /*end scope from beginning of FUNC_ENTER*/
+
#define FUNC_LEAVE_NOAPI(ret_value) \
; \
} /*end scope from end of FUNC_ENTER*/ \
generated by cgit v0.12 at 2024-09-03 11:04:03 (GMT)