netCDFVariable::GetBlockSize(): fix heap buffer write overflow on 2D …

…char variables. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39258
OSGeo · Sep 25, 2021 · da32682 · da32682
1 parent db196a8
commit da32682
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/gdal/frmts/netcdf/netcdfmultidim.cpp b/gdal/frmts/netcdf/netcdfmultidim.cpp
@@ -3077,11 +3077,14 @@ double netCDFVariable::GetOffset(bool* pbHasOffset, GDALDataType* peStorageType)
 
 std::vector<GUInt64> netCDFVariable::GetBlockSize() const
 {
-    std::vector<GUInt64> res(GetDimensionCount());
+    const auto nDimCount = GetDimensionCount();
+    std::vector<GUInt64> res(nDimCount);
     if( res.empty() )
         return res;
     int nStorageType = 0;
-    std::vector<size_t> anTemp(GetDimensionCount());
+    // We add 1 to the dimension count, for 2D char variables that we
+    // expose as a 1D variable.
+    std::vector<size_t> anTemp(1 + nDimCount);
     nc_inq_var_chunking(m_gid, m_varid, &nStorageType, &anTemp[0]);
     if( nStorageType == NC_CHUNKED )
     {