File: CVE-2016-4333.patch

package info (click to toggle)
hdf5 1.10.0-patch1%2Bdocs-3%2Bdeb9u1
  • links: PTS, VCS
  • area: main
  • in suites: stretch
  • size: 143,568 kB
  • sloc: ansic: 472,614; f90: 28,734; java: 27,116; xml: 17,791; sh: 16,757; cpp: 14,937; makefile: 1,769; perl: 1,339; yacc: 338; lex: 184; ruby: 24
file content (23 lines) | stat: -rw-r--r-- 1,116 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
commit bc10fd219e60fc4b9df7d80567ecb1e39ae5b6e3
Author: Neil Fortner <nfortne2@hdfgroup.org>
Date:   Thu Sep 8 13:47:22 2016 -0500

    Change check for number of dimensions for old-style arrays in datatype decoding routine from an assertion to an if/HGOTO_ERROR check, since it is inappropriate to assert the contents of a file will be what we expect.

diff --git a/src/H5Odtype.c b/src/H5Odtype.c
index e51d319..3c3f284 100644
--- a/src/H5Odtype.c
+++ b/src/H5Odtype.c
@@ -311,7 +311,11 @@ H5O_dtype_decode_helper(H5F_t *f, unsigned *ioflags/*in,out*/, const uint8_t **p
                     if(version == H5O_DTYPE_VERSION_1) {
                         /* Decode the number of dimensions */
                         ndims = *(*pp)++;
-                        HDassert(ndims <= 4);
+
+                        /* Check that ndims is valid */
+                        if(ndims > 4)
+                            HGOTO_ERROR(H5E_DATATYPE, H5E_BADTYPE, FAIL, "invalid number of dimensions for array")
+
                         *pp += 3;		/*reserved bytes */
 
                         /* Skip dimension permutation */