Skip to content

Commit

Permalink
Fixed stack buffer overrun due to providing a size that was too large…
Browse files Browse the repository at this point in the history
… for the actual data

Found by ASan:

==19994==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffeefbfe920 at pc 0x0001010b064f bp 0x7ffeefbfc810 sp 0x7ffeefbfbfc0
READ of size 128 at 0x7ffeefbfe920 thread T0
    #0 0x1010b064e in __asan_memcpy (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x5264e)
    HDFGroup#1 0x1002cde61 in H5D__gather_mem H5Dscatgath.c:428
    HDFGroup#2 0x1002d0ca4 in H5D__scatgath_write H5Dscatgath.c:663
    HDFGroup#3 0x10025c948 in H5D__chunk_write H5Dchunk.c:2470
    HDFGroup#4 0x1002c3768 in H5D__write H5Dio.c:819
    HDFGroup#5 0x1002c2650 in H5Dwrite H5Dio.c:335
    HDFGroup#6 0x1000d4b8a in H5TBwrite_fields_index H5TB.c:729
    HDFGroup#7 0x100008c13 in test_table test_table.c:1420
    HDFGroup#8 0x1000028ff in main test_table.c:1686
    HDFGroup#9 0x7fff5eec6014 in start (libdyld.dylib:x86_64+0x1014)

Address 0x7ffeefbfe920 is located in stack of thread T0 at offset 4160 in frame
    #0 0x1000029cf in test_table test_table.c:211
  • Loading branch information
seanm committed Jun 29, 2020
1 parent c44feb8 commit b55cb76
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion hl/test/test_table.c
Original file line number Diff line number Diff line change
Expand Up @@ -1416,7 +1416,7 @@ static int test_table(hid_t fid, int do_write)
/* write the new longitude and latitude information to all the records */
nfields = 2;
start = 0;
nrecords = NRECORDS;
nrecords = NRECORDS_ADD;
if ( H5TBwrite_fields_index(fid, "table12", nfields, field_index_pos, start, nrecords,
sizeof( position_t ), field_offset_pos, field_sizes_pos, position_in ) < 0 )
goto out;
Expand Down

0 comments on commit b55cb76

Please sign in to comment.