#6944 closed defect (fixed)
rdataset not detecting ridiculous string lengths and read gets stuck
Reported by: | Kurt Schwehr | Owned by: | warmerdam |
---|---|---|---|
Priority: | normal | Milestone: | |
Component: | default | Version: | unspecified |
Severity: | normal | Keywords: | r |
Cc: |
Description
This test file is full of ridiculous values. e.g. ReadInt gets an nValue of 1631608512
for
else if( nObjCode % 256 == R_STRSXP ) { int nCount = poDS->ReadInteger(); while( nCount-- > 0 && !VSIFEofL(poDS->fp) ) poDS->ReadString(); }
The vsigzip system gets stuck trying to read but never detects the end of file.
Detected by autofuzz
Attachments (1)
Change History (6)
by , 7 years ago
Attachment: | poc-f63a28e95e5b70c741ba626d42d195d411f7b983b869bc8a5aa8d14c5e5fdbfe added |
---|
Note:
See TracTickets
for help on using tickets.
Malformed rdx gzipped file