Fix buffer checks

HDFGroup · Jan 8, 2025 · efc00ea · efc00ea
1 parent b6bf81a
commit efc00ea
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/c++/src/H5DataType.cpp b/c++/src/H5DataType.cpp
@@ -925,7 +925,7 @@ DataType::close()
         if (encoded_buf != NULL) {
             delete[] encoded_buf;
             encoded_buf = NULL;
-            buf_size = 0;
+            buf_size    = 0;
         }
     }
 }

diff --git a/src/H5T.c b/src/H5T.c
@@ -3807,14 +3807,14 @@ H5T_decode(size_t buf_size, const unsigned char *buf)
     if (NULL == (f = H5F_fake_alloc((uint8_t)0)))
         HGOTO_ERROR(H5E_DATATYPE, H5E_CANTALLOC, NULL, "can't allocate fake file struct");
 
-    if (H5_IS_BUFFER_OVERFLOW(buf, buf_size, 1))
+    if (buf_size != SIZE_MAX && H5_IS_BUFFER_OVERFLOW(buf, 1, buf + buf_size))
         HGOTO_ERROR(H5E_DATATYPE, H5E_BADMESG, NULL, "buffer too small to be datatype message");
 
     /* Decode the type of the information */
     if (*buf++ != H5O_DTYPE_ID)
         HGOTO_ERROR(H5E_DATATYPE, H5E_BADMESG, NULL, "not an encoded datatype");
 
-    if (H5_IS_BUFFER_OVERFLOW(buf, buf_size, 1))
+    if (buf_size != SIZE_MAX && H5_IS_BUFFER_OVERFLOW(buf, 1, buf + buf_size))
         HGOTO_ERROR(H5E_DATATYPE, H5E_BADMESG, NULL, "buffer too small to be datatype message");
 
     /* Decode the version of the datatype information */

diff --git a/src/H5Tpublic.h b/src/H5Tpublic.h
@@ -1457,7 +1457,7 @@ H5_DLL herr_t H5Tencode(hid_t obj_id, void *buf, size_t *nalloc);
  * \return \hid_t{datatype}
  *
  * \details H5Tdecode2() Given an object description of datatype in binary in a
- *          buffer, H5Tdecode() reconstructs the HDF5 datatype object and
+ *          buffer, H5Tdecode2() reconstructs the HDF5 datatype object and
  *          returns a new object handle for it. The binary description of
  *          the object is encoded by H5Tencode(). User is responsible for
  *          passing in the right buffer.