diff --git a/src/H5Faccum.c b/src/H5Faccum.c index 4d713576ca6..b45bce869bf 100644 --- a/src/H5Faccum.c +++ b/src/H5Faccum.c @@ -881,6 +881,11 @@ H5F__accum_free(H5F_shared_t *f_sh, H5FD_mem_t H5_ATTR_UNUSED type, haddr_t addr H5_CHECKED_ASSIGN(overlap_size, size_t, (addr + size) - accum->loc, haddr_t); new_accum_size = accum->size - overlap_size; + /* Ensure that the memmove operation won't overflow past the buffer's allocated size */ + if (H5_IS_BUFFER_OVERFLOW(accum->buf + overlap_size, new_accum_size, + accum->buf + accum->alloc_size - 1)) { + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, FAIL, "memmove operation would overflow buffer"); + } /* Move the accumulator buffer information to eliminate the freed block */ memmove(accum->buf, accum->buf + overlap_size, new_accum_size);