diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/H5Olink.c | 19 | ||||
| -rw-r--r-- | src/H5S.c | 7 |
2 files changed, 23 insertions, 3 deletions
diff --git a/src/H5Olink.c b/src/H5Olink.c index 1f0c6c7..c27b51f 100644 --- a/src/H5Olink.c +++ b/src/H5Olink.c @@ -119,11 +119,12 @@ H5FL_DEFINE_STATIC(H5O_link_t); static void * H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags, unsigned H5_ATTR_UNUSED *ioflags, - size_t H5_ATTR_UNUSED p_size, const uint8_t *p) + size_t p_size, const uint8_t *p) { H5O_link_t *lnk = NULL; /* Pointer to link message */ size_t len = 0; /* Length of a string in the message */ unsigned char link_flags; /* Flags for encoding link info */ + const uint8_t *p_end = p + p_size; /* End of the p buffer */ void *ret_value = NULL; /* Return value */ FUNC_ENTER_STATIC @@ -199,6 +200,11 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, if(len == 0) HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "invalid name length") + /* Make sure that length doesn't exceed buffer size, which could occur + when the file is corrupted */ + if(p + len > p_end) + HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "name length causes read past end of buffer") + /* Get the link's name */ if(NULL == (lnk->name = (char *)H5MM_malloc(len + 1))) HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed") @@ -218,6 +224,12 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, UINT16DECODE(p, len) if(len == 0) HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "invalid link length") + + /* Make sure that length doesn't exceed buffer size, which could occur + when the file is corrupted */ + if(p + len > p_end) + HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "name length causes read past end of buffer") + if(NULL == (lnk->u.soft.name = (char *)H5MM_malloc((size_t)len + 1))) HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed") H5MM_memcpy(lnk->u.soft.name, p, len); @@ -238,6 +250,11 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, lnk->u.ud.size = len; if(len > 0) { + /* Make sure that length doesn't exceed buffer size, which could + occur when the file is corrupted */ + if(p + len > p_end) + HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "name length causes read past end of buffer") + if(NULL == (lnk->u.ud.udata = H5MM_malloc((size_t)len))) HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed") H5MM_memcpy(lnk->u.ud.udata, p, len); @@ -437,6 +437,9 @@ H5S__extent_release(H5S_extent_t *extent) extent->max = H5FL_ARR_FREE(hsize_t, extent->max); } /* end if */ + extent->rank = 0; + extent->nelem = 0; + FUNC_LEAVE_NOAPI(SUCCEED) } /* end H5S__extent_release() */ @@ -1832,7 +1835,7 @@ done: RETURNS Non-negative on success/Negative on failure DESCRIPTION - This function resets the type of a dataspace back to "none" with no + This function resets the type of a dataspace to H5S_NULL with no extent information stored for the dataspace. --------------------------------------------------------------------------*/ herr_t @@ -1852,7 +1855,7 @@ H5Sset_extent_none(hid_t space_id) if(H5S__extent_release(&space->extent) < 0) HGOTO_ERROR(H5E_RESOURCE, H5E_CANTDELETE, FAIL, "can't release previous dataspace") - space->extent.type = H5S_NO_CLASS; + space->extent.type = H5S_NULL; done: FUNC_LEAVE_API(ret_value) |