Skip to content

Conversation

lenzo-ka
Copy link
Contributor

Description

Fixes a heap-buffer-overflow that occurs during error cleanup when reading malformed MLLR files.

The issue was caused by missing validation of dimension parameters. When n_feat or veclen[i] contained invalid values (zero, negative, or extremely large), ckd_calloc_3d would create corrupted array structures. During cleanup, ckd_free_3d would then read invalid metadata causing a heap-buffer-overflow.

Changes:

  • Added validation to ensure n_feat is positive (line 70)
  • Added validation to ensure veclen[i] is positive for each feature (line 82)

Verification steps

  • Compiled successfully with no errors
  • Prevents heap-buffer-overflow during cleanup with malformed input
  • Matches existing validation pattern used for n_class (line 64)

Fixes #433

Replace unsafe %s format specifier with %c%c%c%c to prevent
reading past the 4-byte non-null-terminated id buffer.

Fixes #431
Add validation for n_feat and veclen dimensions to prevent
corrupted allocations that cause heap overflow during cleanup.

Fixes #433
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

Heap-buffer-overflow in ckd_free_3d triggered by ps_mllr_read error cleanup on malformed file

1 participant