Add check for valid fieldname size

As reported by honggfuzz
tbeu · Nov 25, 2017 · 406438f · 406438f
1 parent a32481e
commit 406438f
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/src/mat5.c b/src/mat5.c
@@ -1559,8 +1559,12 @@ ReadNextStructField( mat_t *mat, matvar_t *matvar )
         }
         if ( (uncomp_buf[0] & 0x0000ffff) == MAT_T_INT32 ) {
             fieldname_size = uncomp_buf[1];
+            if ( 0 >= fieldname_size ) {
+                Mat_Critical("Size of fieldname must be positive");
+                return bytesread;
+            }
         } else {
-            Mat_Warning("Error getting fieldname size");
+            Mat_Critical("Error getting fieldname size");
             return bytesread;
         }
 
@@ -1741,8 +1745,12 @@ ReadNextStructField( mat_t *mat, matvar_t *matvar )
         }
         if ( (buf[0] & 0x0000ffff) == MAT_T_INT32 ) {
             fieldname_size = buf[1];
+            if ( 0 >= fieldname_size ) {
+                Mat_Critical("Size of fieldname must be positive");
+                return bytesread;
+            }
         } else {
-            Mat_Warning("Error getting fieldname size");
+            Mat_Critical("Error getting fieldname size");
             return bytesread;
         }
         bytesread+=fread(buf,4,2,(FILE*)mat->fp);