Skip to content

Commit 406438f

Browse files
committed
Add check for valid fieldname size
As reported by honggfuzz
1 parent a32481e commit 406438f

1 file changed

Lines changed: 10 additions & 2 deletions

File tree

‎src/mat5.c‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1559,8 +1559,12 @@ ReadNextStructField( mat_t *mat, matvar_t *matvar )
15591559
}
15601560
if ( (uncomp_buf[0] & 0x0000ffff) == MAT_T_INT32 ) {
15611561
fieldname_size = uncomp_buf[1];
1562+
if ( 0 >= fieldname_size ) {
1563+
Mat_Critical("Size of fieldname must be positive");
1564+
return bytesread;
1565+
}
15621566
} else {
1563-
Mat_Warning("Error getting fieldname size");
1567+
Mat_Critical("Error getting fieldname size");
15641568
return bytesread;
15651569
}
15661570

@@ -1741,8 +1745,12 @@ ReadNextStructField( mat_t *mat, matvar_t *matvar )
17411745
}
17421746
if ( (buf[0] & 0x0000ffff) == MAT_T_INT32 ) {
17431747
fieldname_size = buf[1];
1748+
if ( 0 >= fieldname_size ) {
1749+
Mat_Critical("Size of fieldname must be positive");
1750+
return bytesread;
1751+
}
17441752
} else {
1745-
Mat_Warning("Error getting fieldname size");
1753+
Mat_Critical("Error getting fieldname size");
17461754
return bytesread;
17471755
}
17481756
bytesread+=fread(buf,4,2,(FILE*)mat->fp);

0 commit comments

Comments
 (0)