Skip to content

Commit

Permalink
Shape: avoid being dependent on correctness of file size field in .sh…
Browse files Browse the repository at this point in the history
  • Loading branch information
rouault committed Oct 30, 2018
1 parent 64bbb97 commit 5ed0934
Showing 1 changed file with 27 additions and 25 deletions.
52 changes: 27 additions & 25 deletions gdal/ogr/ogrsf_frmts/shape/shpopen.c
Original file line number Diff line number Diff line change
Expand Up @@ -2151,33 +2151,35 @@ SHPReadObject( SHPHandle psSHP, int hEntity )
/* Before allocating too much memory, check that the file is big enough */
/* and do not trust the file size in the header the first time we */
/* need to allocate more than 10 MB */
if( nNewBufSize >= 10 * 1024 * 1024 &&
psSHP->nBufSize < 10 * 1024 * 1024 )
{
SAOffset nFileSize;
psSHP->sHooks.FSeek( psSHP->fpSHP, 0, 2 );
nFileSize = psSHP->sHooks.FTell(psSHP->fpSHP);
if( nFileSize >= UINT_MAX )
psSHP->nFileSize = UINT_MAX;
else
psSHP->nFileSize = STATIC_CAST(unsigned int, nFileSize);
}

if( psSHP->panRecOffset[hEntity] >= psSHP->nFileSize ||
/* We should normally use nEntitySize instead of*/
/* psSHP->panRecSize[hEntity] in the below test, but because of */
/* the case of non conformant .shx files detailed a bit below, */
/* let be more tolerant */
psSHP->panRecSize[hEntity] > psSHP->nFileSize - psSHP->panRecOffset[hEntity] )
if( nNewBufSize >= 10 * 1024 * 1024 )
{
char str[128];
snprintf( str, sizeof(str),
"Error in fread() reading object of size %d at offset %u from .shp file",
nEntitySize, psSHP->panRecOffset[hEntity] );
str[sizeof(str)-1] = '\0';
if( psSHP->nBufSize < 10 * 1024 * 1024 )
{
SAOffset nFileSize;
psSHP->sHooks.FSeek( psSHP->fpSHP, 0, 2 );
nFileSize = psSHP->sHooks.FTell(psSHP->fpSHP);
if( nFileSize >= UINT_MAX )
psSHP->nFileSize = UINT_MAX;
else
psSHP->nFileSize = STATIC_CAST(unsigned int, nFileSize);
}

psSHP->sHooks.Error( str );
return SHPLIB_NULLPTR;
if( psSHP->panRecOffset[hEntity] >= psSHP->nFileSize ||
/* We should normally use nEntitySize instead of*/
/* psSHP->panRecSize[hEntity] in the below test, but because of */
/* the case of non conformant .shx files detailed a bit below, */
/* let be more tolerant */
psSHP->panRecSize[hEntity] > psSHP->nFileSize - psSHP->panRecOffset[hEntity] )
{
char str[128];
snprintf( str, sizeof(str),
"Error in fread() reading object of size %d at offset %u from .shp file",
nEntitySize, psSHP->panRecOffset[hEntity] );
str[sizeof(str)-1] = '\0';

psSHP->sHooks.Error( str );
return SHPLIB_NULLPTR;
}
}

pabyRecNew = STATIC_CAST(uchar *, SfRealloc(psSHP->pabyRec,nNewBufSize));
Expand Down

0 comments on commit 5ed0934

Please sign in to comment.