aboutsummaryrefslogtreecommitdiff
path: root/package/matio/0003-Fix-illegal-memory-access.patch
diff options
context:
space:
mode:
Diffstat (limited to 'package/matio/0003-Fix-illegal-memory-access.patch')
-rw-r--r--package/matio/0003-Fix-illegal-memory-access.patch46
1 files changed, 0 insertions, 46 deletions
diff --git a/package/matio/0003-Fix-illegal-memory-access.patch b/package/matio/0003-Fix-illegal-memory-access.patch
deleted file mode 100644
index 787207f217..0000000000
--- a/package/matio/0003-Fix-illegal-memory-access.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 65831b7ec829b0ae0ac9d691a2f8fbc2b26af677 Mon Sep 17 00:00:00 2001
-From: tbeu <tbeu@users.noreply.github.com>
-Date: Mon, 11 Nov 2019 22:03:54 +0100
-Subject: [PATCH] Fix illegal memory access
-
-As reported by https://github.com/tbeu/matio/issues/129
-
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
-[Retrieved from:
-https://github.com/tbeu/matio/commit/65831b7ec829b0ae0ac9d691a2f8fbc2b26af677]
----
- src/mat5.c | 18 +++++++++++++++++-
- 1 file changed, 17 insertions(+), 1 deletion(-)
-
-diff --git a/src/mat5.c b/src/mat5.c
-index b76a331..5e3464e 100644
---- a/src/mat5.c
-+++ b/src/mat5.c
-@@ -989,10 +989,26 @@ ReadNextCell( mat_t *mat, matvar_t *matvar )
- /* Rank and Dimension */
- if ( uncomp_buf[0] == MAT_T_INT32 ) {
- int j;
-+ size_t size;
- cells[i]->rank = uncomp_buf[1];
- nbytes -= cells[i]->rank;
- cells[i]->rank /= 4;
-- cells[i]->dims = (size_t*)malloc(cells[i]->rank*sizeof(*cells[i]->dims));
-+ if ( 0 == do_clean && cells[i]->rank > 13 ) {
-+ int rank = cells[i]->rank;
-+ cells[i]->rank = 0;
-+ Mat_Critical("%d is not a valid rank", rank);
-+ continue;
-+ }
-+ err = SafeMul(&size, cells[i]->rank, sizeof(*cells[i]->dims));
-+ if ( err ) {
-+ if ( do_clean )
-+ free(dims);
-+ Mat_VarFree(cells[i]);
-+ cells[i] = NULL;
-+ Mat_Critical("Integer multiplication overflow");
-+ continue;
-+ }
-+ cells[i]->dims = (size_t*)malloc(size);
- if ( mat->byteswap ) {
- for ( j = 0; j < cells[i]->rank; j++ )
- cells[i]->dims[j] = Mat_uint32Swap(dims + j);