CVE-2023-37186 (published 2023-12-25T07:15Z)

C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/Blosc/c-blosc2
commit_details: repo_url: https://github.com/Blosc/c-blosc2
author: Marta Iborra
author_date: 2023-06-21 11:17:51+02:00
msg: Fix #522
repository: repo_url: https://github.com/Blosc/c-blosc2
repo_name: Blosc/c-blosc2
description: A fast, compressed, persistent binary data store library for C.
repo_language: C
owner: Blosc
file_changes: filename: ndlz4x4.c
change_type: ModificationType.MODIFY
diff: @@ -59,6 +59,8 @@
 int ndlz4_compress(const uint8_t *input, int32_t input_len, uint8_t *output, int32_t output_len,
                    uint8_t meta, blosc2_cparams *cparams) {
   BLOSC_UNUSED_PARAM(meta);
+  BLOSC_ERROR_NULL(cparams, BLOSC2_ERROR_NULL_POINTER);
+  BLOSC_ERROR_NULL(cparams->schunk, BLOSC2_ERROR_NULL_POINTER);
   uint8_t *smeta;
   int32_t smeta_len;
 
@@ -513,6 +515,8 @@ int ndlz4_decompress(const uint8_t *input, int32_t input_len, uint8_t *output, i
                      uint8_t meta, blosc2_dparams *dparams) {
   BLOSC_UNUSED_PARAM(meta);
   BLOSC_UNUSED_PARAM(dparams);
+  BLOSC_ERROR_NULL(input, BLOSC2_ERROR_NULL_POINTER);
+  BLOSC_ERROR_NULL(output, BLOSC2_ERROR_NULL_POINTER);
 
   uint8_t *ip = (uint8_t *) input;
   uint8_t *ip_limit = ip + input_len;
@@ -541,7 +545,7 @@ int ndlz4_decompress(const uint8_t *input, int32_t input_len, uint8_t *output, i
   eshape[0] = ((blockshape[0] + 3) / 4) * 4;
   eshape[1] = ((blockshape[1] + 3) / 4) * 4;
 
-  if (NDLZ_UNEXPECT_CONDITIONAL(output_len < (int32_t) (blockshape[0] * blockshape[1]))) {
+  if (NDLZ_UNEXPECT_CONDITIONAL((int64_t)output_len < (int64_t)blockshape[0] * (int64_t)blockshape[1])) {
     return 0;
   }
   memset(op, 0, blockshape[0] * blockshape[1]);

programming_language: C
filename: ndlz8x8.c
change_type: ModificationType.MODIFY
diff: @@ -59,6 +59,8 @@
 int ndlz8_compress(const uint8_t *input, int32_t input_len, uint8_t *output, int32_t output_len,
                    uint8_t meta, blosc2_cparams *cparams) {
   BLOSC_UNUSED_PARAM(meta);
+  BLOSC_ERROR_NULL(cparams, BLOSC2_ERROR_NULL_POINTER);
+  BLOSC_ERROR_NULL(cparams->schunk, BLOSC2_ERROR_NULL_POINTER);
   uint8_t *smeta;
   int32_t smeta_len;
 
@@ -430,6 +432,8 @@ int ndlz8_decompress(const uint8_t *input, int32_t input_len, uint8_t *output, i
                      uint8_t meta, blosc2_dparams *dparams) {
   BLOSC_UNUSED_PARAM(meta);
   BLOSC_UNUSED_PARAM(dparams);
+  BLOSC_ERROR_NULL(input, BLOSC2_ERROR_NULL_POINTER);
+  BLOSC_ERROR_NULL(output, BLOSC2_ERROR_NULL_POINTER);
 
   const int cell_shape = 8;
   const int cell_size = 64;
@@ -458,8 +462,7 @@ int ndlz8_decompress(const uint8_t *input, int32_t input_len, uint8_t *output, i
   ip += 4;
   eshape[0] = ((blockshape[0] + 7) / cell_shape) * cell_shape;
   eshape[1] = ((blockshape[1] + 7) / cell_shape) * cell_shape;
-
-  if (NDLZ_UNEXPECT_CONDITIONAL(output_len < blockshape[0] * blockshape[1])) {
+  if (NDLZ_UNEXPECT_CONDITIONAL((int64_t)output_len < (int64_t)blockshape[0] * (int64_t)blockshape[1])) {
     return 0;
   }
   memset(op, 0, blockshape[0] * blockshape[1]);

programming_language: C