From efc00ea5a9315046fe9ffdbcc5402c95878c4748 Mon Sep 17 00:00:00 2001 From: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 8 Jan 2025 21:30:56 +0000 Subject: [PATCH] Fix buffer checks --- c++/src/H5DataType.cpp | 2 +- src/H5T.c | 4 ++-- src/H5Tpublic.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/c++/src/H5DataType.cpp b/c++/src/H5DataType.cpp index dd80a260c16..55a32eac2a7 100644 --- a/c++/src/H5DataType.cpp +++ b/c++/src/H5DataType.cpp @@ -925,7 +925,7 @@ DataType::close() if (encoded_buf != NULL) { delete[] encoded_buf; encoded_buf = NULL; - buf_size = 0; + buf_size = 0; } } } diff --git a/src/H5T.c b/src/H5T.c index 641347f1a5b..a334674b4a9 100644 --- a/src/H5T.c +++ b/src/H5T.c @@ -3807,14 +3807,14 @@ H5T_decode(size_t buf_size, const unsigned char *buf) if (NULL == (f = H5F_fake_alloc((uint8_t)0))) HGOTO_ERROR(H5E_DATATYPE, H5E_CANTALLOC, NULL, "can't allocate fake file struct"); - if (H5_IS_BUFFER_OVERFLOW(buf, buf_size, 1)) + if (buf_size != SIZE_MAX && H5_IS_BUFFER_OVERFLOW(buf, 1, buf + buf_size)) HGOTO_ERROR(H5E_DATATYPE, H5E_BADMESG, NULL, "buffer too small to be datatype message"); /* Decode the type of the information */ if (*buf++ != H5O_DTYPE_ID) HGOTO_ERROR(H5E_DATATYPE, H5E_BADMESG, NULL, "not an encoded datatype"); - if (H5_IS_BUFFER_OVERFLOW(buf, buf_size, 1)) + if (buf_size != SIZE_MAX && H5_IS_BUFFER_OVERFLOW(buf, 1, buf + buf_size)) HGOTO_ERROR(H5E_DATATYPE, H5E_BADMESG, NULL, "buffer too small to be datatype message"); /* Decode the version of the datatype information */ diff --git a/src/H5Tpublic.h b/src/H5Tpublic.h index 8b885cea4e2..aae96ea951f 100644 --- a/src/H5Tpublic.h +++ b/src/H5Tpublic.h @@ -1457,7 +1457,7 @@ H5_DLL herr_t H5Tencode(hid_t obj_id, void *buf, size_t *nalloc); * \return \hid_t{datatype} * * \details H5Tdecode2() Given an object description of datatype in binary in a - * buffer, H5Tdecode() reconstructs the HDF5 datatype object and + * buffer, H5Tdecode2() reconstructs the HDF5 datatype object and * returns a new object handle for it. The binary description of * the object is encoded by H5Tencode(). User is responsible for * passing in the right buffer.