heap-buffer-overflow in getArray

[0xdd96]

To Reproduce

Environment

• OS: Ubuntu 24.04.1 LTS
• Compiler: gcc version 13.3.0
• version: latest commit dd315a8

poc: poc

Steps to reproduce the behavior:

CFLAGS="-g -O0" CXXFLAGS="-g -O0" cmake ..
make
./mysofa2json $POC

Expected behavior

ubuntu@3d76fd667859:~/libmysofa$ valgrind ./mysofa2json ./poc
==2317644== Memcheck, a memory error detector
==2317644== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==2317644== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==2317644== Command: ./mysofa2json ./poc
==2317644==
==2317644== Warning: set address range perms: large range [0x59c93040, 0xd9c93058) (defined)
==2317644== Invalid read of size 8
==2317644==    at 0x10BDE0: getArray (reader.c:183)
==2317644==    by 0x10C365: getHrtf (reader.c:323)
==2317644==    by 0x10C6A0: load (reader.c:363)
==2317644==    by 0x10C7A4: mysofa_load (reader.c:388)
==2317644==    by 0x10A8FB: main (sofa2json.c:103)
==2317644==  Address 0xd9c93058 is 0 bytes after a block of size 2,147,483,672 alloc'd
==2317644==    at 0x484D953: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==2317644==    by 0x10E06D: readOHDRHeaderMessageDataLayout (dataobject.c:552)
==2317644==    by 0x10F14B: readOHDRmessages (dataobject.c:1125)
==2317644==    by 0x10F508: dataobjectRead (dataobject.c:1229)
==2317644==    by 0x110D85: directblockRead (fractalhead.c:239)
==2317644==    by 0x1119ED: fractalheapRead (fractalhead.c:639)
==2317644==    by 0x10F610: dataobjectRead (dataobject.c:1254)
==2317644==    by 0x10CC27: superblockRead2or3 (superblock.c:64)
==2317644==    by 0x10CFBE: superblockRead (superblock.c:204)
==2317644==    by 0x10C67D: load (reader.c:361)
==2317644==    by 0x10C7A4: mysofa_load (reader.c:388)
==2317644==    by 0x10A8FB: main (sofa2json.c:103)
==2317644==
==2317644==
==2317644== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==2317644==  Access not within mapped region at address 0xD9C94000
==2317644==    at 0x10BDE0: getArray (reader.c:183)
==2317644==    by 0x10C365: getHrtf (reader.c:323)
==2317644==    by 0x10C6A0: load (reader.c:363)
==2317644==    by 0x10C7A4: mysofa_load (reader.c:388)
==2317644==    by 0x10A8FB: main (sofa2json.c:103)
==2317644==  If you believe this happened as a result of a stack
==2317644==  overflow in your program's main thread (unlikely but
==2317644==  possible), you can try to increase the size of the
==2317644==  main thread stack using the --main-stacksize= flag.
==2317644==  The main thread stack size used in this run was 8388608.
==2317644==
==2317644== HEAP SUMMARY:
==2317644==     in use at exit: 2,147,497,295 bytes in 175 blocks
==2317644==   total heap usage: 192 allocs, 17 frees, 2,147,553,684 bytes allocated
==2317644==
==2317644== LEAK SUMMARY:
==2317644==    definitely lost: 0 bytes in 0 blocks
==2317644==    indirectly lost: 0 bytes in 0 blocks
==2317644==      possibly lost: 0 bytes in 0 blocks
==2317644==    still reachable: 2,147,497,295 bytes in 175 blocks
==2317644==         suppressed: 0 bytes in 0 blocks
==2317644== Rerun with --leak-check=full to see details of leaked memory
==2317644==
==2317644== For lists of detected and suppressed errors, rerun with: -s
==2317644== ERROR SUMMARY: 502 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault