bound MATLAB_class and MATLAB_sparse attribute reads to one element - #324
Open
naruto-lgtm wants to merge 1 commit into
Open
bound MATLAB_class and MATLAB_sparse attribute reads to one element#324naruto-lgtm wants to merge 1 commit into
naruto-lgtm wants to merge 1 commit into
Conversation
Contributor
Author
|
any update? |
Owner
|
Seen it. |
tbeu
force-pushed
the
mat73-attr-scalar-read
branch
from
August 11, 2026 20:06
85aa3b1 to
650faa0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repro: open a v7.3 file whose MATLAB_class attribute (read for every variable) or MATLAB_sparse attribute (on a struct/sparse group) is stored with a simple dataspace of two or more elements.
Cause: both are read with a bare H5Aread into a single-element destination, calloc(class_len+1) for the class string in Mat_H5ReadVarInfo and a stack
unsigned nrowsin Mat_H5ReadGroupInfo, but H5Aread copies the whole attribute, so a multi-element attribute writes past the destination during Mat_VarReadNextInfo. ASan shows a heap write of 14 bytes at mat73.c:591 and a stack write of 8 bytes at mat73.c:1068.Fix: read both through Mat_H5ReadScalarAttribute, which already rejects a non-scalar attribute before the copy, the same guard the MATLAB_global, MATLAB_int_decode and MATLAB_empty reads use.