Opened 16 years ago

Closed 16 years ago

#2488 closed defect (duplicate)

integer overflow -> segfault with ReadRaster

Reported by: timaranz Owned by: hobu
Priority: normal Milestone:
Component: SWIG (all bindings) Version: 1.5.2
Severity: normal Keywords:
Cc:

Description

I naively tried to load an elevation grid which was 16764 x 20264 pixels into a buffer of doubles. Silly me. The first line of DSReadRaster_internal (line 42 of swig\include\Dataset.i) overflows *buf_size = buf_xsize * buf_ysize * (GDALGetDataTypeSize( buf_type ) / 8) * band_list;

became

*buf_size = 16764 * 20264 * 8 * 1;

Need to check for overflow and raise an error if:

buf_xsize > (1 << 31) / (buf_ysize * (GDALGetDataTypeSize( buf_type ) / 8) * band_list))

Change History (2)

comment:1 by timaranz, 16 years ago

Version: unspecified1.5.2

comment:2 by Even Rouault, 16 years ago

Resolution: duplicate
Status: newclosed

This is a duplicate of #2140. Closing

Note: See TracTickets for help on using tickets.