OilfieldToolsNet/ResInsight
4
0
Fork 0
mirror of https://github.com/OPM/ResInsight.git synced 2026-08-27 05:37:21 -05:00
Code Issues Packages Projects Releases Wiki Activity

#14144 Guard against buffer overflow when reading corrupt well data records

Browse Source 
A truncated or corrupt restart file could provide a Fortran record-length header larger than the destination buffer, causing fortio_fread_record to fread past the heap allocation and crash. Bound each record read to the remaining buffer capacity and treat an oversized record as a read failure, which propagates up as a normal failed read instead of a segfault.
This commit is contained in:
Magne Sjaastad
2026-06-08 15:54:52 +02:00
parent 96eaa2cff3
commit 668b844051
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ThirdParty/Ert/lib/ecl/fortio.c
Vendored
+4 -2
View File
@@ -523,8 +523,10 @@ bool fortio_complete_read(fortio_type *fortio , int record_size) {
bytes read; the function will return -1 on failure.
*/
static int fortio_fread_record(fortio_type *fortio , char *buffer) {
static int fortio_fread_record(fortio_type *fortio , char *buffer , int max_record_size) {
int record_size = fortio_init_read(fortio);
if (record_size > max_record_size)
return -1; /* Corrupt/inconsistent record header: would overflow buffer */
if (record_size >= 0) {
size_t items_read = fread(buffer , 1 , record_size , fortio->stream);
if (items_read == record_size) {
@@ -552,7 +554,7 @@ bool fortio_fread_buffer(fortio_type * fortio, char * buffer , int buffer_size)
while (true) {
char * buffer_ptr = &buffer[total_bytes_read];
int bytes_read = fortio_fread_record(fortio , buffer_ptr);
int bytes_read = fortio_fread_record(fortio , buffer_ptr , buffer_size - total_bytes_read);
if (bytes_read < 0)
break;