Fix bad argument for H5S_get_simple_extent_dims

As reported by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66627
tbeu · Mar 10, 2024 · 1565241 · 1565241
1 parent b19346a
commit 1565241
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/src/mat73.c b/src/mat73.c
@@ -623,18 +623,20 @@ Mat_H5ReadFieldNames(matvar_t *matvar, hid_t dset_id, hsize_t *nfields)
     hsize_t i;
     hid_t attr_id, space_id;
     herr_t herr;
-    int err;
+    int err, ndims;
 
     attr_id = H5Aopen_by_name(dset_id, ".", "MATLAB_fields", H5P_DEFAULT, H5P_DEFAULT);
     space_id = H5Aget_space(attr_id);
-    err = H5Sget_simple_extent_dims(space_id, nfields, NULL);
-    if ( err < 0 ) {
+    ndims = H5Sget_simple_extent_ndims(space_id);
+    if ( 0 > ndims || 1 < ndims ) {
+        *nfields = 0;
         H5Sclose(space_id);
         H5Aclose(attr_id);
         return MATIO_E_GENERIC_READ_ERROR;
     } else {
         err = MATIO_E_NO_ERROR;
     }
+    (void)H5Sget_simple_extent_dims(space_id, nfields, NULL);
     if ( *nfields > 0 ) {
         hid_t field_id;
         hvl_t *fieldnames_vl = (hvl_t *)calloc((size_t)(*nfields), sizeof(*fieldnames_vl));