Skip to content

Commit f577e29

Browse files
Stefan Weilstweil
Stefan Weil
authored andcommitted
Increase limit and add assertions for deserialization of large arrays
One of the checks was too restrictive, as lstmeval deserializes char arrays with 14000000 elements, so raise the limit to 30000000. That check was added in commit 992031e. Add also assertions which help finding such problems in debug mode. Signed-off-by: Stefan Weil <stweil@ub-backup.bib.uni-mannheim.de>
1 parent 364ffeb commit f577e29

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

src/ccutil/genericvector.h

+7-2
Original file line numberDiff line numberDiff line change
@@ -568,7 +568,10 @@ class PointerVector : public GenericVector<T*> {
568568
if (fread(&reserved, sizeof(reserved), 1, fp) != 1) return false;
569569
if (swap) Reverse32(&reserved);
570570
// Arbitrarily limit the number of elements to protect against bad data.
571-
if (reserved > UINT16_MAX) return false;
571+
assert(reserved <= UINT16_MAX);
572+
if (reserved > UINT16_MAX) {
573+
return false;
574+
}
572575
GenericVector<T*>::reserve(reserved);
573576
truncate(0);
574577
for (uint32_t i = 0; i < reserved; ++i) {
@@ -949,6 +952,7 @@ bool GenericVector<T>::DeSerialize(bool swap, FILE* fp) {
949952
if (fread(&reserved, sizeof(reserved), 1, fp) != 1) return false;
950953
if (swap) Reverse32(&reserved);
951954
// Arbitrarily limit the number of elements to protect against bad data.
955+
assert(reserved <= UINT16_MAX);
952956
if (reserved > UINT16_MAX) return false;
953957
reserve(reserved);
954958
size_used_ = reserved;
@@ -964,7 +968,8 @@ bool GenericVector<T>::DeSerialize(tesseract::TFile* fp) {
964968
uint32_t reserved;
965969
if (fp->FReadEndian(&reserved, sizeof(reserved), 1) != 1) return false;
966970
// Arbitrarily limit the number of elements to protect against bad data.
967-
if (reserved > UINT16_MAX) return false;
971+
assert(reserved <= 30000000);
972+
if (reserved > 30000000) return false;
968973
reserve(reserved);
969974
size_used_ = reserved;
970975
return fp->FReadEndian(data_, sizeof(T), size_used_) == size_used_;

0 commit comments

Comments
 (0)