Fix illegal memory access

As reported by #108
tbeu · Mar 22, 2019 · 02625a0 · 02625a0
1 parent e697a0a
commit 02625a0
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/mat5.c b/src/mat5.c
@@ -2686,6 +2686,13 @@ Mat_VarRead5(mat_t *mat, matvar_t *matvar)
             if ( 0 == matvar->nbytes ) {
                 break;
             }
+            {
+                size_t nbytes;
+                err = SafeMul(&nbytes, nelems, matvar->data_size);
+                if ( err || nbytes > matvar->nbytes ) {
+                    break;
+                }
+            }
             if ( matvar->compression == MAT_COMPRESSION_NONE ) {
                 nBytes = ReadCharData(mat,(char*)matvar->data,packed_type,(int)nelems);
                 /*