Skip to content

[BP][626] [io] Improve checks when reading arrays with TBufferFile #21871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dpiparo merged 3 commits into from
Apr 9, 2026
Merged

[BP][626] [io] Improve checks when reading arrays with TBufferFile #21871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2b4bf42
[io] Check the number of characters in ReadCharStar
dpiparo Apr 7, 2026
4091e0b
[io] Sync 2 truth sources of buffer length in TBuffer
dpiparo Apr 9, 2026
4bfa38f
[io] TBufferFile: more checks when reading arrays
dpiparo Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions core/base/src/TBuffer.cxx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,6 +305,7 @@ void TBuffer::SetReadMode()
// We had reserved space for the free block count,
// release it,
fBufSize += kExtraSpace;
fBufMax = fBuffer + fBufSize;
}
fMode = kRead;
}
Expand All @@ -318,6 +319,7 @@ void TBuffer::SetWriteMode()
// We had not yet reserved space for the free block count,
// reserve it now.
fBufSize -= kExtraSpace;
fBufMax = fBuffer + fBufSize;
}
fMode = kWrite;
}
Expand Down
11 changes: 11 additions & 0 deletions io/io/inc/TBufferFile.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ class TBufferFile : public TBufferIO {
UInt_t CheckObject(UInt_t offset, const TClass *cl, Bool_t readClass = kFALSE);

void WriteObjectClass(const void *actualObjStart, const TClass *actualClass, Bool_t cacheReuse) override;
bool ShouldNotReadCollection(Int_t lengthInBytes, Int_t nElements=1) const;

public:
enum { kStreamedMemberWise = BIT(14) }; //added to version number to know if a collection has been stored member-wise
Expand Down Expand Up @@ -268,6 +269,16 @@ class TBufferFile : public TBufferIO {

//---------------------- TBufferFile inlines ---------------------------------------

//______________________________________________________________________________
inline bool TBufferFile::ShouldNotReadCollection(Int_t lengthInBytes, Int_t nElements) const
{
// Three cases here in which we should not read the collection:
// 1. The collection has zero or a negative number of elements or
// 2. The length in bytes of the collection is zero or negative
// 3. The remaining part of the buffer is too short to read the collection
return nElements <= 0 || lengthInBytes <= 0 || (size_t)lengthInBytes > (size_t)(fBufMax - fBufCur);
}

//______________________________________________________________________________
inline void TBufferFile::WriteBool(Bool_t b)
{
Expand Down
74 changes: 39 additions & 35 deletions io/io/src/TBufferFile.cxx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,10 @@ void TBufferFile::ReadCharStar(char* &s)
Int_t nch;
*this >> nch;
if (nch > 0) {
if (nch == std::numeric_limits<Int_t>::max()) {
Error("ReadCharStar", "Cannot allocate buffer: maximum capacity exceeded (%d bytes)!", std::numeric_limits<Int_t>::max());
return;
}
s = new char[nch+1];
ReadFastArray(s, nch);
s[nch] = 0;
Expand Down Expand Up @@ -704,7 +708,7 @@ Int_t TBufferFile::ReadArray(Bool_t *&b)
Int_t n;
*this >> n;

if (n <= 0 || n > fBufSize) return 0;
if (ShouldNotReadCollection(n)) return 0;

if (!b) b = new Bool_t[n];

Expand Down Expand Up @@ -733,7 +737,7 @@ Int_t TBufferFile::ReadArray(Char_t *&c)
*this >> n;
Int_t l = sizeof(Char_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!c) c = new Char_t[n];

Expand All @@ -756,7 +760,7 @@ Int_t TBufferFile::ReadArray(Short_t *&h)
*this >> n;
Int_t l = sizeof(Short_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!h) h = new Short_t[n];

Expand Down Expand Up @@ -789,7 +793,7 @@ Int_t TBufferFile::ReadArray(Int_t *&ii)
*this >> n;
Int_t l = sizeof(Int_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!ii) ii = new Int_t[n];

Expand Down Expand Up @@ -822,7 +826,7 @@ Int_t TBufferFile::ReadArray(Long_t *&ll)
*this >> n;
Int_t l = sizeof(Long_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!ll) ll = new Long_t[n];

Expand All @@ -848,7 +852,7 @@ Int_t TBufferFile::ReadArray(Long64_t *&ll)
*this >> n;
Int_t l = sizeof(Long64_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!ll) ll = new Long64_t[n];

Expand Down Expand Up @@ -876,7 +880,7 @@ Int_t TBufferFile::ReadArray(Float_t *&f)
*this >> n;
Int_t l = sizeof(Float_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!f) f = new Float_t[n];

Expand Down Expand Up @@ -909,7 +913,7 @@ Int_t TBufferFile::ReadArray(Double_t *&d)
*this >> n;
Int_t l = sizeof(Double_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!d) d = new Double_t[n];

Expand Down Expand Up @@ -937,7 +941,7 @@ Int_t TBufferFile::ReadArrayFloat16(Float_t *&f, TStreamerElement *ele)
Int_t n;
*this >> n;

if (n <= 0 || 3*n > fBufSize) return 0;
if (ShouldNotReadCollection(3*n, n)) return 0;

if (!f) f = new Float_t[n];

Expand All @@ -959,7 +963,7 @@ Int_t TBufferFile::ReadArrayDouble32(Double_t *&d, TStreamerElement *ele)
Int_t n;
*this >> n;

if (n <= 0 || 3*n > fBufSize) return 0;
if (ShouldNotReadCollection(3*n, n)) return 0;

if (!d) d = new Double_t[n];

Expand All @@ -979,7 +983,7 @@ Int_t TBufferFile::ReadStaticArray(Bool_t *b)
Int_t n;
*this >> n;

if (n <= 0 || n > fBufSize) return 0;
if (ShouldNotReadCollection(n)) return 0;

if (!b) return 0;

Expand Down Expand Up @@ -1007,7 +1011,7 @@ Int_t TBufferFile::ReadStaticArray(Char_t *c)
*this >> n;
Int_t l = sizeof(Char_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!c) return 0;

Expand All @@ -1029,7 +1033,7 @@ Int_t TBufferFile::ReadStaticArray(Short_t *h)
*this >> n;
Int_t l = sizeof(Short_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!h) return 0;

Expand Down Expand Up @@ -1061,7 +1065,7 @@ Int_t TBufferFile::ReadStaticArray(Int_t *ii)
*this >> n;
Int_t l = sizeof(Int_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!ii) return 0;

Expand Down Expand Up @@ -1093,7 +1097,7 @@ Int_t TBufferFile::ReadStaticArray(Long_t *ll)
*this >> n;
Int_t l = sizeof(Long_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!ll) return 0;

Expand All @@ -1118,7 +1122,7 @@ Int_t TBufferFile::ReadStaticArray(Long64_t *ll)
*this >> n;
Int_t l = sizeof(Long64_t)*n;

if (l <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!ll) return 0;

Expand All @@ -1145,7 +1149,7 @@ Int_t TBufferFile::ReadStaticArray(Float_t *f)
*this >> n;
Int_t l = sizeof(Float_t)*n;

if (n <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!f) return 0;

Expand Down Expand Up @@ -1177,7 +1181,7 @@ Int_t TBufferFile::ReadStaticArray(Double_t *d)
*this >> n;
Int_t l = sizeof(Double_t)*n;

if (n <= 0 || l > fBufSize) return 0;
if (ShouldNotReadCollection(l, n)) return 0;

if (!d) return 0;

Expand All @@ -1204,7 +1208,7 @@ Int_t TBufferFile::ReadStaticArrayFloat16(Float_t *f, TStreamerElement *ele)
Int_t n;
*this >> n;

if (n <= 0 || 3*n > fBufSize) return 0;
if (ShouldNotReadCollection(3*n, n)) return 0;

if (!f) return 0;

Expand All @@ -1225,7 +1229,7 @@ Int_t TBufferFile::ReadStaticArrayDouble32(Double_t *d, TStreamerElement *ele)
Int_t n;
*this >> n;

if (n <= 0 || 3*n > fBufSize) return 0;
if (ShouldNotReadCollection(3*n, n)) return 0;

if (!d) return 0;

Expand All @@ -1239,7 +1243,7 @@ Int_t TBufferFile::ReadStaticArrayDouble32(Double_t *d, TStreamerElement *ele)

void TBufferFile::ReadFastArray(Bool_t *b, Int_t n)
{
if (n <= 0 || n > fBufSize) return;
if (ShouldNotReadCollection(n)) return;

if (sizeof(Bool_t) > 1) {
for (int i = 0; i < n; i++)
Expand All @@ -1256,7 +1260,7 @@ void TBufferFile::ReadFastArray(Bool_t *b, Int_t n)

void TBufferFile::ReadFastArray(Char_t *c, Int_t n)
{
if (n <= 0 || n > fBufSize) return;
if (ShouldNotReadCollection(n)) return;

Int_t l = sizeof(Char_t)*n;
memcpy(c, fBufCur, l);
Expand All @@ -1277,7 +1281,7 @@ void TBufferFile::ReadFastArrayString(Char_t *c, Int_t n)
*this >> len;
}
if (len) {
if (len <= 0 || len > fBufSize) return;
if (ShouldNotReadCollection(len)) return;
Int_t blen = len;
if (len >= n) len = n-1;

Expand All @@ -1297,7 +1301,7 @@ void TBufferFile::ReadFastArrayString(Char_t *c, Int_t n)
void TBufferFile::ReadFastArray(Short_t *h, Int_t n)
{
Int_t l = sizeof(Short_t)*n;
if (n <= 0 || l > fBufSize) return;
if (ShouldNotReadCollection(l, n)) return;

#ifdef R__BYTESWAP
# ifdef USE_BSWAPCPY
Expand All @@ -1319,7 +1323,7 @@ void TBufferFile::ReadFastArray(Short_t *h, Int_t n)
void TBufferFile::ReadFastArray(Int_t *ii, Int_t n)
{
Int_t l = sizeof(Int_t)*n;
if (l <= 0 || l > fBufSize) return;
if (ShouldNotReadCollection(l, n)) return;

#ifdef R__BYTESWAP
# ifdef USE_BSWAPCPY
Expand All @@ -1341,7 +1345,7 @@ void TBufferFile::ReadFastArray(Int_t *ii, Int_t n)
void TBufferFile::ReadFastArray(Long_t *ll, Int_t n)
{
Int_t l = sizeof(Long_t)*n;
if (l <= 0 || l > fBufSize) return;
if (ShouldNotReadCollection(l, n)) return;

TFile *file = (TFile*)fParent;
if (file && file->GetVersion() < 30006) {
Expand All @@ -1357,7 +1361,7 @@ void TBufferFile::ReadFastArray(Long_t *ll, Int_t n)
void TBufferFile::ReadFastArray(Long64_t *ll, Int_t n)
{
Int_t l = sizeof(Long64_t)*n;
if (l <= 0 || l > fBufSize) return;
if (ShouldNotReadCollection(l, n)) return;

#ifdef R__BYTESWAP
for (int i = 0; i < n; i++)
Expand All @@ -1374,7 +1378,7 @@ void TBufferFile::ReadFastArray(Long64_t *ll, Int_t n)
void TBufferFile::ReadFastArray(Float_t *f, Int_t n)
{
Int_t l = sizeof(Float_t)*n;
if (l <= 0 || l > fBufSize) return;
if (ShouldNotReadCollection(l, n)) return;

#ifdef R__BYTESWAP
# ifdef USE_BSWAPCPY
Expand All @@ -1396,7 +1400,7 @@ void TBufferFile::ReadFastArray(Float_t *f, Int_t n)
void TBufferFile::ReadFastArray(Double_t *d, Int_t n)
{
Int_t l = sizeof(Double_t)*n;
if (l <= 0 || l > fBufSize) return;
if (ShouldNotReadCollection(l, n)) return;

#ifdef R__BYTESWAP
for (int i = 0; i < n; i++)
Expand All @@ -1413,7 +1417,7 @@ void TBufferFile::ReadFastArray(Double_t *d, Int_t n)

void TBufferFile::ReadFastArrayFloat16(Float_t *f, Int_t n, TStreamerElement *ele)
{
if (n <= 0 || 3*n > fBufSize) return;
if (ShouldNotReadCollection(3*n, n)) return;

if (ele && ele->GetFactor() != 0) {
//a range was specified. We read an integer and convert it back to a float
Expand Down Expand Up @@ -1453,7 +1457,7 @@ void TBufferFile::ReadFastArrayFloat16(Float_t *f, Int_t n, TStreamerElement *el

void TBufferFile::ReadFastArrayWithFactor(Float_t *ptr, Int_t n, Double_t factor, Double_t minvalue)
{
if (n <= 0 || 3*n > fBufSize) return;
if (ShouldNotReadCollection(3*n, n)) return;

//a range was specified. We read an integer and convert it back to a float
for (int j=0;j < n; j++) {
Expand All @@ -1467,7 +1471,7 @@ void TBufferFile::ReadFastArrayWithFactor(Float_t *ptr, Int_t n, Double_t factor

void TBufferFile::ReadFastArrayWithNbits(Float_t *ptr, Int_t n, Int_t nbits)
{
if (n <= 0 || 3*n > fBufSize) return;
if (ShouldNotReadCollection(3*n, n)) return;

if (!nbits) nbits = 12;
//we read the exponent and the truncated mantissa of the float
Expand Down Expand Up @@ -1495,7 +1499,7 @@ void TBufferFile::ReadFastArrayWithNbits(Float_t *ptr, Int_t n, Int_t nbits)

void TBufferFile::ReadFastArrayDouble32(Double_t *d, Int_t n, TStreamerElement *ele)
{
if (n <= 0 || 3*n > fBufSize) return;
if (ShouldNotReadCollection(3*n, n)) return;

if (ele && ele->GetFactor() != 0) {
//a range was specified. We read an integer and convert it back to a double.
Expand Down Expand Up @@ -1543,7 +1547,7 @@ void TBufferFile::ReadFastArrayDouble32(Double_t *d, Int_t n, TStreamerElement *

void TBufferFile::ReadFastArrayWithFactor(Double_t *d, Int_t n, Double_t factor, Double_t minvalue)
{
if (n <= 0 || 3*n > fBufSize) return;
if (ShouldNotReadCollection(3*n, n)) return;

//a range was specified. We read an integer and convert it back to a double.
for (int j=0;j < n; j++) {
Expand All @@ -1557,7 +1561,7 @@ void TBufferFile::ReadFastArrayWithFactor(Double_t *d, Int_t n, Double_t factor,

void TBufferFile::ReadFastArrayWithNbits(Double_t *d, Int_t n, Int_t nbits)
{
if (n <= 0 || 3*n > fBufSize) return;
if (ShouldNotReadCollection(3*n, n)) return;

if (!nbits) {
//we read a float and convert it to double
Expand Down
Loading