Skip to content

Fix heap-buffer-overflow in ps_mllr_read#439

Merged
dhdaines merged 2 commits intomainfrom
fix-mllr-heap-overflow
Oct 23, 2025
Merged

Fix heap-buffer-overflow in ps_mllr_read#439
dhdaines merged 2 commits intomainfrom
fix-mllr-heap-overflow

Conversation

@lenzo-ka
Copy link
Contributor

Description

Fixes a heap-buffer-overflow that occurs during error cleanup when reading malformed MLLR files.

The issue was caused by missing validation of dimension parameters. When n_feat or veclen[i] contained invalid values (zero, negative, or extremely large), ckd_calloc_3d would create corrupted array structures. During cleanup, ckd_free_3d would then read invalid metadata causing a heap-buffer-overflow.

Changes:

  • Added validation to ensure n_feat is positive (line 70)
  • Added validation to ensure veclen[i] is positive for each feature (line 82)

Verification steps

  • Compiled successfully with no errors
  • Prevents heap-buffer-overflow during cleanup with malformed input
  • Matches existing validation pattern used for n_class (line 64)

Fixes #433

Replace unsafe %s format specifier with %c%c%c%c to prevent
reading past the 4-byte non-null-terminated id buffer.

Fixes #431
Add validation for n_feat and veclen dimensions to prevent
corrupted allocations that cause heap overflow during cleanup.

Fixes #433
@lenzo-ka lenzo-ka requested a review from dhdaines October 23, 2025 18:21
Copy link
Contributor

@dhdaines dhdaines left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, another one of these issues (I might even be responsable for this one).

@dhdaines dhdaines merged commit 8830670 into main Oct 23, 2025
21 checks passed
@dhdaines dhdaines deleted the fix-mllr-heap-overflow branch October 23, 2025 20:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

Heap-buffer-overflow in ckd_free_3d triggered by ps_mllr_read error cleanup on malformed file

2 participants