Added test for offset in datablock that points outside the datablock.

stcorp · Nov 23, 2021 · d908268 · d908268
1 parent f12b850
commit d908268
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/libcoda/coda-cdf-cursor.c b/libcoda/coda-cdf-cursor.c
@@ -425,8 +425,13 @@ static int read_basic_type(const coda_cursor *cursor, void *dst, long size_bound
     {
         value_size = size_boundary;
     }
-    if (variable->data != NULL)
+    if ((variable->data != NULL) && (value_size > 0))
     {
+        if (offset > (variable->num_records * variable->num_values_per_record * variable->value_size))
+        {
+            coda_set_error(CODA_ERROR_UNSUPPORTED_PRODUCT, "Offset too large in accessing data of CDF variable");
+            return -1;
+        }
         memcpy(dst, &variable->data[offset], value_size);
     }
     else