1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
Description: Fix array index out of bounds when printing bad UTF-8 character data
This fixes a security issue with identifier CVE-2025-2337.
Origin: upstream, https://github.com/tbeu/matio/commit/67000893b627205c42abc125d7917b6b2d18f84f
Bug: https://github.com/tbeu/matio/issues/267
Bug-Debian: https://bugs.debian.org/1100992
Last-Update: 2025-04-29
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- a/src/mat.c
+++ b/src/mat.c
@@ -2367,6 +2367,7 @@ Mat_VarPrint(const matvar_t *matvar, int
case MAT_T_UTF8: {
const mat_uint8_t *data = (const mat_uint8_t *)matvar->data;
size_t k = 0;
+ int err = 0;
size_t *idxOffset;
if ( matvar->nbytes == 0 ) {
break;
@@ -2376,6 +2377,9 @@ Mat_VarPrint(const matvar_t *matvar, int
break;
}
for ( i = 0; i < matvar->dims[0]; i++ ) {
+ if ( err ) {
+ break;
+ }
for ( j = 0; j < matvar->dims[1]; j++ ) {
mat_uint8_t c;
if ( k >= matvar->nbytes ) {
@@ -2384,16 +2388,36 @@ Mat_VarPrint(const matvar_t *matvar, int
idxOffset[i * matvar->dims[1] + j] = k;
c = data[k];
if ( c <= 0x7F ) {
- } else if ( (c & 0xE0) == 0xC0 && k + 1 < matvar->nbytes ) {
- k = k + 1;
- } else if ( (c & 0xF0) == 0xE0 && k + 2 < matvar->nbytes ) {
- k = k + 2;
- } else if ( (c & 0xF8) == 0xF0 && k + 3 < matvar->nbytes ) {
- k = k + 3;
+ } else if ( (c & 0xE0) == 0xC0 ) {
+ if ( k + 1 < matvar->nbytes ) {
+ k += 1;
+ } else {
+ err = 1;
+ break;
+ }
+ } else if ( (c & 0xF0) == 0xE0 ) {
+ if ( k + 2 < matvar->nbytes ) {
+ k += 2;
+ } else {
+ err = 1;
+ break;
+ }
+ } else if ( (c & 0xF8) == 0xF0 ) {
+ if ( k + 3 < matvar->nbytes ) {
+ k += 3;
+ } else {
+ err = 1;
+ break;
+ }
}
++k;
}
}
+ if ( err ) {
+ free(idxOffset);
+ Mat_Message("UTF-8 character data error at index %zu", k);
+ break;
+ }
for ( i = 0; i < matvar->dims[0]; i++ ) {
for ( j = 0; j < matvar->dims[1]; j++ ) {
mat_uint8_t c;
|
