Skip to content

Commit

Permalink
Fixed buffer over-read from strlen due to missing space for null term…
Browse files Browse the repository at this point in the history
…inator

Found by ASan:

==18515==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200001a791 at pc 0x00010111b47a bp 0x7ffeefbfe8f0 sp 0x7ffeefbfe098
READ of size 2 at 0x60200001a791 thread T0
    #0 0x10111b479 in wrap_strlen (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x14479)
    HDFGroup#1 0x100841c4c in H5T__conv_vlen H5Tconv.c:3193
    HDFGroup#2 0x1008113d9 in H5T_convert H5T.c:5024
    HDFGroup#3 0x100379fbb in H5D__scatgath_write H5Dscatgath.c:701
    HDFGroup#4 0x10032d235 in H5D__contig_write H5Dcontig.c:657
    HDFGroup#5 0x10036c768 in H5D__write H5Dio.c:819
    HDFGroup#6 0x10036b650 in H5Dwrite H5Dio.c:335
    HDFGroup#7 0x100115fa7 in H5::DataSet::write(void const*, H5::DataType const&, H5::DataSpace const&, H5::DataSpace const&, H5::DSetMemXferPropList const&) const H5DataSet.cpp:506
    HDFGroup#8 0x100031d9a in test_vlstrings tvlstr.cpp:191
    HDFGroup#9 0x1001aec42 in PerformTests testframe.c:323
    HDFGroup#10 0x100002ac0 in main testhdf5.cpp:116
    HDFGroup#11 0x7fff5eec6014 in start (libdyld.dylib:x86_64+0x1014)

0x60200001a791 is located 0 bytes to the right of 1-byte region [0x60200001a790,0x60200001a791)
allocated by thread T0 here:
    #0 0x10115c547 in wrap_calloc (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x55547)
    HDFGroup#1 0x100031d70 in test_vlstrings tvlstr.cpp:187
    HDFGroup#2 0x1001aec42 in PerformTests testframe.c:323
    HDFGroup#3 0x100002ac0 in main testhdf5.cpp:116
    HDFGroup#4 0x7fff5eec6014 in start (libdyld.dylib:x86_64+0x1014)
  • Loading branch information
seanm committed Jun 29, 2020
1 parent 2c97c22 commit b06e1d9
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion c++/test/tvlstr.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,7 @@ static void test_vlstring_dataset()
// Test scalar type dataset with 1 value.
dset1 = root.createDataSet("test_scalar_small", vlst, ds_space);

dynstring_ds_write = (char*)HDcalloc(1, sizeof(char));
dynstring_ds_write = (char*)HDcalloc(2, sizeof(char));
HDmemset(dynstring_ds_write, 'A', 1);

// Write data to the dataset, then read it back.
Expand Down

0 comments on commit b06e1d9

Please sign in to comment.