From d0ae12151059159ffb1871ced8148a8fe53a6306 Mon Sep 17 00:00:00 2001 From: aled-ua Date: Thu, 9 Jan 2025 10:33:02 +0800 Subject: [PATCH] use H5_IS_BUFFER_OVERFLOW to check overflow --- src/H5Faccum.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/H5Faccum.c b/src/H5Faccum.c index 17de72dce57..7f7e33bc3f2 100644 --- a/src/H5Faccum.c +++ b/src/H5Faccum.c @@ -881,10 +881,10 @@ H5F__accum_free(H5F_shared_t *f_sh, H5FD_mem_t H5_ATTR_UNUSED type, haddr_t addr H5_CHECKED_ASSIGN(overlap_size, size_t, (addr + size) - accum->loc, haddr_t); new_accum_size = accum->size - overlap_size; - /* Ensure overlap_size and new_accum_size are within bounds */ - if (overlap_size > accum->alloc_size || new_accum_size > accum->alloc_size) { - HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, FAIL, - "calculated sizes exceed allocated buffer size"); + /* Ensure that the memmove operation won't overflow past the buffer's allocated size */ + if (H5_IS_BUFFER_OVERFLOW(accum->buf + overlap_size, new_accum_size, accum->buf + accum->alloc_size)) { + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, FAIL, + "memmove operation would overflow buffer"); } /* Move the accumulator buffer information to eliminate the freed block */