CVE-2023-37188: NULL Pointer Dereference (CWE-476)
value: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2023-12-25T07:15Z
Repository: https://github.com/Blosc/c-blosc2
Language: C
Files changed: plugins/codecs/zfp/blosc2-zfp.c
Commit date: 2023-06-21 11:16:28 +0200
Commit message: Fix for #519 #520 #521

Diff: diff --git a/plugins/codecs/zfp/blosc2-zfp.c b/plugins/codecs/zfp/blosc2-zfp.c
index d824eeb8..41d08d0d 100644
--- a/plugins/codecs/zfp/blosc2-zfp.c
+++ b/plugins/codecs/zfp/blosc2-zfp.c
@@ -24,10 +24,11 @@ int zfp_acc_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
                      int32_t output_len, uint8_t meta, blosc2_cparams *cparams, const void *chunk) {
   BLOSC_UNUSED_PARAM(chunk);
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   double tol = (int8_t) meta;
   int8_t ndim;
   int64_t *shape = malloc(8 * sizeof(int64_t));
   int32_t *chunkshape = malloc(8 * sizeof(int32_t));
@@ -144,10 +145,11 @@ int zfp_acc_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
 int zfp_acc_decompress(const uint8_t *input, int32_t input_len, uint8_t *output,
                        int32_t output_len, uint8_t meta, blosc2_dparams *dparams, const void *chunk) {
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;
   int32_t typesize = sc->typesize;
 
@@ -239,10 +241,11 @@ int zfp_prec_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
                       int32_t output_len, uint8_t meta, blosc2_cparams *cparams, const void *chunk) {
   BLOSC_UNUSED_PARAM(chunk);
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   int8_t ndim;
   int64_t *shape = malloc(8 * sizeof(int64_t));
   int32_t *chunkshape = malloc(8 * sizeof(int32_t));
   int32_t *blockshape = malloc(8 * sizeof(int32_t));
@@ -383,10 +386,11 @@ int zfp_prec_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
 int zfp_prec_decompress(const uint8_t *input, int32_t input_len, uint8_t *output,
                         int32_t output_len, uint8_t meta, blosc2_dparams *dparams, const void *chunk) {
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;
   int32_t typesize = sc->typesize;
   int8_t ndim;
@@ -502,10 +506,11 @@ int zfp_rate_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
                       int32_t output_len, uint8_t meta, blosc2_cparams *cparams, const void *chunk) {
   BLOSC_UNUSED_PARAM(chunk);
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   double ratio = (double) meta / 100.0;
   int8_t ndim;
   int64_t *shape = malloc(8 * sizeof(int64_t));
   int32_t *chunkshape = malloc(8 * sizeof(int32_t));
@@ -633,10 +638,11 @@ int zfp_rate_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
 int zfp_rate_decompress(const uint8_t *input, int32_t input_len, uint8_t *output,
                         int32_t output_len, uint8_t meta, blosc2_dparams *dparams, const void *chunk) {
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;
   int32_t typesize = sc->typesize;
 

Fixed code:   ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);