Opened 11 years ago

Closed 11 years ago

Last modified 9 years ago

#4266 closed defect (fixed)

Grib driver can crash depending on level values

Reported by: ejones Owned by: warmerdam
Priority: normal Milestone:
Component: GDAL_Raster Version: unspecified
Severity: normal Keywords: grib
Cc:

Description

This is something we had to change a while back to fix a crash problem, and would like to get this fix added to the official distribution.

In frmts/grib/degrib18/degrib/metaname.cpp, consider the following code from ParseLevelName:

   char valBuff[20];
   char sndBuff[20];
   GRIB2SurfTable surf = Table45Index (surfType, &f_reserved, center,
                                       subcenter);

   /* Check if index is defined... 191 is undefined. */
   free (*shortLevelName);
   *shortLevelName = NULL;
   free (*longLevelName);
   *longLevelName = NULL;
   sprintf (valBuff, "%f", value);
   strTrimRight (valBuff, '0');
   if (valBuff[strlen (valBuff) - 1] == '.') {
      valBuff[strlen (valBuff) - 1] = '\0';
   }
   if (f_sndValue) {
      sprintf (sndBuff, "%f", sndValue);

Note that sndBuff and valBuff are only declared with a max size of 20 characters, but then used with a format string of "%f" -- which always uses fixed notation, never scientific (unlike %g, which would use scientific notation if it were more compact). So if the value is 1e25, for example, it will print all 25 zeroes, overflowing the buffers.

We changed the sizes of sndBuff and valBuff to 512. I believe that would cover all possible output from %f, since the largest double precision floating point number is somewhere around 1e308.

Attachments (1)

parse_level_name_patch.txt (491 bytes ) - added by ejones 11 years ago.
Proposed patch

Download all attachments as: .zip

Change History (3)

by ejones, 11 years ago

Attachment: parse_level_name_patch.txt added

Proposed patch

comment:1 by Even Rouault, 11 years ago

Component: defaultGDAL_Raster
Keywords: grib added
Milestone: 1.8.2
Resolution: fixed
Status: newclosed

r23136 /trunk/gdal/frmts/grib/degrib18/degrib/metaname.cpp: GRIB: Fix crash depending on level values (#4266)

r23137 /branches/1.8/gdal/frmts/grib/degrib18/degrib/metaname.cpp: GRIB: Fix crash depending on level values (#4266)

comment:2 by Even Rouault, 9 years ago

Milestone: 1.8.2

Milestone 1.8.2 deleted

Note: See TracTickets for help on using tickets.