core
/
eccodes
mirror of https://github.com/ecmwf/eccodes.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ECC-1083: codes_bufr_extract_headers_malloc: Infinite loop when invalid file passed in

This commit is contained in:
Shahram Najm 2020-02-26 12:11:15 +00:00
parent cb54cd1ee1
commit 68d0980e8b
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/bufr_util.c
View File

@ -571,7 +571,7 @@ static int count_bufr_messages(grib_context* c, FILE* f, int* n, int strict_mode
while (!done) {
mesg = wmo_read_bufr_from_file_malloc(f, 0, &size, &offset, &err);
/*printf("Count so far=%ld, mesg=%x, err=%d (%s)\n", *count, mesg, err, grib_get_error_message(err));*/
/*printf("Count so far=%d, mesg=%x, err=%d (%s)\n", *n, mesg, err, grib_get_error_message(err));*/
if (!mesg) {
if (err == GRIB_END_OF_FILE || err == GRIB_PREMATURE_END_OF_FILE) {
done = 1; /* reached the end */
@ -584,7 +584,13 @@ static int count_bufr_messages(grib_context* c, FILE* f, int* n, int strict_mode
grib_context_free(c, mesg);
}
(*n)++;
if (*n >= INT_MAX/100) {
grib_context_log(c, GRIB_LOG_ERROR, "Limit reached: looped %d times without finding a valid BUFR message", *n);
done = 1;
err = GRIB_INTERNAL_ERROR;
}
}
rewind(f);
if (err == GRIB_END_OF_FILE)
err = GRIB_SUCCESS;
@ -601,6 +607,10 @@ int codes_bufr_extract_headers_malloc(grib_context* c, const char* filename, cod
if (!c)
c = grib_context_get_default();
if (path_is_directory(filename)) {
grib_context_log(c, GRIB_LOG_ERROR, "codes_bufr_extract_headers_malloc: \"%s\" is a directory", filename);
return GRIB_IO_PROBLEM;
}
fp = fopen(filename, "rb");
if (!fp) {
grib_context_log(c, GRIB_LOG_ERROR, "codes_bufr_extract_headers_malloc: Unable to read file \"%s\"", filename);

8
tests/bufr_extract_headers.sh
View File

@ -204,4 +204,12 @@ for bf in ${bufr_files}; do
done
echo "Test with invalid inputs..."
# ---------------------------------
set +e
$EXEC ${test_dir}/bufr_extract_headers centre ${data_dir}
status=$?
set -e
[ $status -ne 0 ]
rm -f $temp1 $temp2