mirror of
https://github.com/HDFGroup/hdf5.git
synced 2026-09-25 04:09:44 +03:00
Scot Breitenfeld
2c674737e5
* Fix stack buffer overflows in h5repack_parse.c (issue #6433) Five sites in parse_filter() wrote to fixed 16-byte stack buffers (scomp[16], stype[16]) via unbounded loop indices with no prior bounds check, causing a stack-buffer-overflow on malformed -f arguments: Site 1: scomp[k] - filter name token before '=' Site 2: stype[m] - SZIP pixels_per_block digit sequence Site 3: stype[m] - SOFF scale_factor digit sequence Site 4: stype[q] - UD legacy per-field digit sequence Site 5: stype[m] - all-other-filters digit sequence Replace all five bare array writes with a single PARSE_BUF_WRITE macro that checks the index against sizeof(buf)-1 before writing, then frees obj_list and exits with an error message on overflow — consistent with all other error handling in parse_filter(). Confirmed with AddressSanitizer: overflow is eliminated and invalid over-long arguments produce a clean diagnostic exit instead of UB. * Fix stack buffer overflows in h5repack_parse.c (issue #6433) All five overflow sites in parse_filter() are now protected via a PARSE_BUF_WRITE macro that takes an explicit buf_sz argument (passed as sizeof(buf) at every call site) to avoid silent pointer-decay if the buffers are ever refactored to heap allocations. In the SZIP and SOFF inner loops the previous code wrote bare `smask[l] = c` with no bounds check, and relied on `i = len - 1` to stop the *outer* loop without also breaking the *inner* `u` loop. That left one additional iteration where `l` could equal 2 and `smask[2]` would be written by the next outer iteration before the outer loop condition was re-evaluated. Both sites now use PARSE_BUF_WRITE and add an explicit `break` to exit the inner loop as soon as the two-character mask is complete. The NULL guard around free(obj_list_ptr) is removed: free(NULL) is a safe no-op per C99 §7.20.3.2.