Fix for potential crash when reading invalid .vdb files.

Original fix thanks to Matthias Ueberheide. Signed-off-by: Jeff Lait <[email protected]>
AcademySoftwareFoundation · Nov 1, 2023 · b5bba2c · b5bba2c
1 parent 49dc158
commit b5bba2c
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 10 deletions.
diff --git a/openvdb/openvdb/io/Compression.cc b/openvdb/openvdb/io/Compression.cc
@@ -123,20 +123,23 @@ unzipFromStream(std::istream& is, char* data, size_t numBytes)
 {
     // Read the size of the compressed data.
     // A negative size indicates uncompressed data.
-    Int64 numZippedBytes;
+    Int64 numZippedBytes{0};
     is.read(reinterpret_cast<char*>(&numZippedBytes), 8);
+    if (!is.good())
+        OPENVDB_THROW(RuntimeError, "Stream failure reading the size of a zip chunk");
 
     if (numZippedBytes <= 0) {
+        // Check for an error
+        if (size_t(-numZippedBytes) != numBytes) {
+            OPENVDB_THROW(RuntimeError, "Expected to read a " << numBytes
+                << "-byte chunk, got a " << -numZippedBytes << "-byte chunk");
+        }
         // Read the uncompressed data.
         if (data == nullptr) {
             is.seekg(-numZippedBytes, std::ios_base::cur);
         } else {
             is.read(data, -numZippedBytes);
         }
-        if (size_t(-numZippedBytes) != numBytes) {
-            OPENVDB_THROW(RuntimeError, "Expected to read a " << numBytes
-                << "-byte chunk, got a " << -numZippedBytes << "-byte chunk");
-        }
     } else {
         if (data == nullptr) {
             // Seek over the compressed data.
@@ -268,20 +271,24 @@ bloscFromStream(std::istream& is, char* data, size_t numBytes)
 {
     // Read the size of the compressed data.
     // A negative size indicates uncompressed data.
-    Int64 numCompressedBytes;
+    Int64 numCompressedBytes{0};
     is.read(reinterpret_cast<char*>(&numCompressedBytes), 8);
 
+    if (!is.good())
+        OPENVDB_THROW(RuntimeError, "Stream failure reading the size of a blosc chunk");
+
     if (numCompressedBytes <= 0) {
+        // Check for an error
+        if (size_t(-numCompressedBytes) != numBytes) {
+            OPENVDB_THROW(RuntimeError, "Expected to read a " << numBytes
+                << "-byte uncompressed chunk, got a " << -numCompressedBytes << "-byte chunk");
+        }
         // Read the uncompressed data.
         if (data == nullptr) {
             is.seekg(-numCompressedBytes, std::ios_base::cur);
         } else {
             is.read(data, -numCompressedBytes);
         }
-        if (size_t(-numCompressedBytes) != numBytes) {
-            OPENVDB_THROW(RuntimeError, "Expected to read a " << numBytes
-                << "-byte uncompressed chunk, got a " << -numCompressedBytes << "-byte chunk");
-        }
     } else {
         if (data == nullptr) {
             // Seek over the compressed data.

diff --git a/pendingchanges/iofix.txt b/pendingchanges/iofix.txt
@@ -0,0 +1,3 @@
+Bug Fixes:
+    - Fix potential crash reading corrupt .vdb files with invalid
+      blosc or zip chunks.  [Fix thanks to Matthias Ueberheide]