Grib driver can crash depending on level values

[ejones]

This is something we had to change a while back to fix a crash problem, and would like to get this fix added to the official distribution.

In frmts/grib/degrib18/degrib/metaname.cpp, consider the following code from ParseLevelName:

   char valBuff[20];
   char sndBuff[20];
   GRIB2SurfTable surf = Table45Index (surfType, &f_reserved, center,
                                       subcenter);

   /* Check if index is defined... 191 is undefined. */
   free (*shortLevelName);
   *shortLevelName = NULL;
   free (*longLevelName);
   *longLevelName = NULL;
   sprintf (valBuff, "%f", value);
   strTrimRight (valBuff, '0');
   if (valBuff[strlen (valBuff) - 1] == '.') {
      valBuff[strlen (valBuff) - 1] = '\0';
   }
   if (f_sndValue) {
      sprintf (sndBuff, "%f", sndValue);

Note that sndBuff and valBuff are only declared with a max size of 20 characters, but then used with a format string of "%f" -- which always uses fixed notation, never scientific (unlike %g, which would use scientific notation if it were more compact). So if the value is 1e25, for example, it will print all 25 zeroes, overflowing the buffers.

We changed the sizes of sndBuff and valBuff to 512. I believe that would cover all possible output from %f, since the largest double precision floating point number is somewhere around 1e308.

[ejones]

Proposed patch

[Even Rouault]

r23136 /trunk/gdal/frmts/grib/degrib18/degrib/metaname.cpp: GRIB: Fix crash depending on level values (#4266)

r23137 /branches/1.8/gdal/frmts/grib/degrib18/degrib/metaname.cpp: GRIB: Fix crash depending on level values (#4266)

[Even Rouault]

Milestone 1.8.2 deleted