Add buffer overrun checks to H5O__layout_decode and H5O__sdspace_decode #2679
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jhendersonHDF
added
Merge - To 1.12
Priority - 1. High 🔼
jhendersonHDF
requested review from
lrknox,
derobins,
byrnHDF,
fortnern,
qkoziol,
vchoi-hdfgroup,
bmribler,
glennsong09,
mattjala and
brtnfld
as code owners
jhendersonHDF
force-pushed
the
layout_space_decode_checks
branch
from
70c5d53 to
c17ca84
Compare
jhendersonHDF
commented
Apr 6, 2023
| /* Check if a read of size bytes starting at ptr would overflow past | ||
| * the last valid byte, pointed to by buffer_end. | ||
| */ | ||
| #define H5_IS_BUFFER_OVERFLOW(ptr, size, buffer_end) (((ptr) + (size)-1) > (buffer_end)) |
There was a problem hiding this comment.
Borrowing this until we determine final placement..
qkoziol
approved these changes
Apr 6, 2023
"Address overflowed" seems a bit awkward to me as well to describe the issue that occurred, but I don't have any strong opinion either way. I can change it. |
jhendersonHDF
force-pushed
the
layout_space_decode_checks
branch
2 times, most recently
from
21b9dd7 to
47bb446
Compare
mattjala
reviewed
Apr 10, 2023
src/H5Olayout.c
Outdated
| @@ -164,29 +180,46 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU | |||
| * size in the dataset code, where we've got the dataspace | |||
| * information available also. - QAK 5/26/04 | |||
| */ | |||
| if (H5_IS_BUFFER_OVERFLOW(p, (ndims * sizeof(uint32_t)), p_end)) | |||
| HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding") | |||
| p += ndims * 4; /* Skip over dimension sizes (32-bit quantities) */ | |||
There was a problem hiding this comment.
Could this '4' be replaced with a size call to match the overflow check?
There was a problem hiding this comment.
Sure. Changed.
jhendersonHDF
force-pushed
the
layout_space_decode_checks
branch
from
47bb446 to
df97bbc
Compare
lrknox
approved these changes
Apr 11, 2023
brtnfld
pushed a commit
to brtnfld/hdf5
that referenced
this pull request
Apr 13, 2023
…de (HDFGroup#2679) Co-authored-by: Larry Knox <[email protected]>
jhendersonHDF
added a commit
to jhendersonHDF/hdf5
that referenced
this pull request
Apr 13, 2023
…de (HDFGroup#2679) Co-authored-by: Larry Knox <[email protected]>
jhendersonHDF
added a commit
to jhendersonHDF/hdf5
that referenced
this pull request
Apr 13, 2023
…de (HDFGroup#2679) Co-authored-by: Larry Knox <[email protected]>
jhendersonHDF
added a commit
to jhendersonHDF/hdf5
that referenced
this pull request
Apr 13, 2023
…de (HDFGroup#2679) Co-authored-by: Larry Knox <[email protected]>
This was referenced Apr 13, 2023
derobins
pushed a commit
that referenced
this pull request
Apr 15, 2023
derobins
pushed a commit
that referenced
this pull request
Apr 15, 2023
derobins
pushed a commit
that referenced
this pull request
Apr 15, 2023
byrnHDF
pushed a commit
to byrnHDF/hdf5
that referenced
this pull request
Apr 16, 2023
…de (HDFGroup#2679) Co-authored-by: Larry Knox <[email protected]>
brtnfld
pushed a commit
to brtnfld/hdf5
that referenced
this pull request
May 17, 2023
…de (HDFGroup#2679) Co-authored-by: Larry Knox <[email protected]>
brtnfld
pushed a commit
to brtnfld/hdf5
that referenced
this pull request
Oct 5, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.