philipp/hdf5
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix HDFFV-10591

Browse Source 
Description:
    h52gif produced a segfault when a buffer overflow occurred because
    the data size was corrupted and became very large.  This commit added
    a check on the data size against the buffer size to prevent the segfault.
    It also added error reporting to h52gif to display an error message
    instead of silently exiting when the failure occurred.
Platforms tested:
    Linux/64 (jelly)
    SunOS 5.11 (emu)
This commit is contained in:
Binh-Minh Ribler
2020-06-19 10:53:32 -05:00
parent d20000ec51
commit c12da4884f
3 changed files with 29 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
hl/src/H5IM.c
View File

@@ -274,7 +274,8 @@ herr_t H5IMget_image_info( hid_t loc_id,
return -1;
/* Try to find the attribute "INTERLACE_MODE" on the >>image<< dataset */
has_attr = H5LT_find_attribute(did, "INTERLACE_MODE");
if ((has_attr = H5LT_find_attribute(did, "INTERLACE_MODE")) < 0)
goto out;
/* It exists, get it */
if(has_attr == 1)

33
hl/tools/gif2h5/hdf2gif.c
View File

@@ -149,30 +149,41 @@ int main(int argc , char **argv)
goto out;
}
/* read image */
/* get image's information */
if ( H5IMget_image_info( fid, image_name, &width, &height, &planes, interlace, &npals ) < 0 )
{
fprintf(stderr , "Unable to get information of the image. Aborting.\n");
goto out;
}
if (width > IMAGE_WIDTH_MAX || height > IMAGE_HEIGHT_MAX){
fprintf(stderr, "HDF5 image is too large. Limit is %d by %d.\n", IMAGE_WIDTH_MAX, IMAGE_HEIGHT_MAX);
goto out;
}
if (width > IMAGE_WIDTH_MAX || height > IMAGE_HEIGHT_MAX)
{
fprintf(stderr, "HDF5 image is too large. Limit is %d by %d.\n", IMAGE_WIDTH_MAX, IMAGE_HEIGHT_MAX);
goto out;
}
/* tool can handle single plane images only. */
if (planes > 1){
fprintf(stderr, "Cannot handle multiple planes image\n");
goto out;
}
/* tool can handle single plane images only. */
if (planes > 1)
{
fprintf(stderr, "Cannot handle multiple planes image\n");
goto out;
}
Image = (GIFBYTE*) malloc( (size_t) width * (size_t) height );
if ( H5IMread_image( fid, image_name, Image ) < 0 )
{
fprintf(stderr , "Unable to read the image. Aborting.\n");
goto out;
}
if (npals)
{
if ( H5IMget_palette_info( fid, image_name, 0, pal_dims ) < 0 )
{
fprintf(stderr , "Unable to get information of the palette. Aborting.\n");
goto out;
}
pal = (GIFBYTE*) malloc( (size_t) pal_dims[0] * (size_t) pal_dims[1] );
@@ -246,7 +257,7 @@ int main(int argc , char **argv)
if (j==i)
{
/* wasn't found */
pc2nc[i] = (GIFBYTE)nc;
pc2nc[i] = (GIFBYTE)nc;
r1[nc] = Red[i];
g1[nc] = Green[i];
b1[nc] = Blue[i];

5
src/H5Oattr.c
View File

@@ -238,6 +238,11 @@ H5O_attr_decode(H5F_t *f, H5O_t *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
/* Go get the data */
if(attr->shared->data_size) {
/* Ensure that data size doesn't exceed buffer size, in case of
it's being corrupted in the file */
if(attr->shared->data_size > p_size)
HGOTO_ERROR(H5E_RESOURCE, H5E_OVERFLOW, NULL, "data size exceeds buffer size")
if(NULL == (attr->shared->data = H5FL_BLK_MALLOC(attr_buf, attr->shared->data_size)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
H5MM_memcpy(attr->shared->data, p, attr->shared->data_size);