Skip to content

Conversation

@jim-p-w
Copy link
Contributor

@jim-p-w jim-p-w commented Oct 14, 2025

This PR fixes a potential buffer overrun when reading string variables from a netcdf file.

A fixed size array is provided as an output buffer when reading a 0d-char character variable.
Call MPAS_io_inq_var prior to the read to get the size of the variable, and only proceed with the read if the size of the variable will fit in the provided array.
Return an error code if the variable value is larger than the provided output buffer.

A unit test is included to verify:

  1. An attempt to read a string variable into a buffer which is too small to hold the string value is detected
  2. When a buffer which is too small is detected, the read won't occur and an error code is returned
  3. When the test is run via valgrind, valgrind detects no memory errors or corruption
  4. If the code which detects the too small buffer is commented out the test crashes and valgrind reports memory corruption

Fixes issue #1350

Note

When building with PIO, if the charArray (or the charArray1d) value exceeds the size of the tempchar buffer provided to the call to PIO_get_var, the value will be truncated to the size of the provided tempchar buffer (lines 2018, 2023, and 2042 in src/framework/mpas_io.F).

@jim-p-w jim-p-w marked this pull request as draft October 14, 2025 22:29
@mgduda mgduda requested review from amstokely and mgduda October 15, 2025 15:51
@jim-p-w jim-p-w force-pushed the atmosphere/check_buffer_len branch from 3d97db2 to d610024 Compare October 16, 2025 16:14
@jim-p-w jim-p-w marked this pull request as ready for review October 16, 2025 16:48
@jim-p-w jim-p-w force-pushed the atmosphere/check_buffer_len branch from d610024 to 7f2f3a8 Compare December 22, 2025 21:13
@mgduda mgduda self-requested a review December 28, 2025 19:53
Copy link
Contributor

@mgduda mgduda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jim-p-w I've verified that the changes to mpas_io.F catch cases where we would otherwise have tried to read a string into a buffer that was too small. If you could rework the commit history so that it contains just a couple of commits -- perhaps one to modify the framework mpas_io code, and another to add unit tests -- I think we'll be ready to merge this.

@jim-p-w
Copy link
Contributor Author

jim-p-w commented Jan 5, 2026

@mgduda Is the initial commit message in the PR suitable for the framework commit? Or do you have suggestions/edits you would prefer to see?

A fixed size array is provided as an input buffer when reading 0d-char
character variables.
Call MPAS_io_inq_var prior to the read to get the size of the variable’s value,
and only proceed with the read if the variable’s value will fit in the
provided array.
Return an error code if the variable’s value is larger than the provided
input buffer.
Character variables are read into fixed size arrays when reading netcdf
files. A test is added which tries to read character variables into a
buffer which isn't large enough to hold the data. The test verifies the
read fails with a suitable error code.
@jim-p-w jim-p-w force-pushed the atmosphere/check_buffer_len branch from 7b258f4 to 9bdcede Compare January 5, 2026 21:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants