Check charge, radical and isotope blocks for string length

Signed-off-by: Geoff Hutchison <geoff.hutchison@gmail.com>
OpenChemistry · Jan 23, 2025 · dff8003 · dff8003
1 parent a1e0b0c
commit dff8003
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/avogadro/io/mdlformat.cpp b/avogadro/io/mdlformat.cpp
@@ -230,6 +230,11 @@ bool MdlFormat::read(std::istream& in, Core::Molecule& mol)
       if (!foundChgProperty)
         chargeList.clear(); // Forget old-style charges
       size_t entryCount(lexicalCast<int>(buffer.substr(6, 3), ok));
+      if (buffer.length() < 17 + 8 * entryCount) {
+        appendError("Error parsing charge block.");
+        return false;
+      }
+
       for (size_t i = 0; i < entryCount; i++) {
         size_t index(lexicalCast<size_t>(buffer.substr(10 + 8 * i, 3), ok) - 1);
         if (!ok) {
@@ -250,6 +255,11 @@ bool MdlFormat::read(std::istream& in, Core::Molecule& mol)
       // radical center
       spinMultiplicity = 1; // reset and count
       size_t entryCount(lexicalCast<int>(buffer.substr(6, 3), ok));
+      if (buffer.length() < 17 + 8 * entryCount) {
+        appendError("Error parsing radical block.");
+        return false;
+      }
+
       for (size_t i = 0; i < entryCount; i++) {
         size_t index(lexicalCast<size_t>(buffer.substr(10 + 8 * i, 3), ok) - 1);
         if (!ok) {
@@ -273,6 +283,11 @@ bool MdlFormat::read(std::istream& in, Core::Molecule& mol)
     } else if (prefix == "M  ISO") {
       // isotope
       size_t entryCount(lexicalCast<int>(buffer.substr(6, 3), ok));
+      if (buffer.length() < 17 + 8 * entryCount) {
+        appendError("Error parsing isotope block.");
+        return false;
+      }
+
       for (size_t i = 0; i < entryCount; i++) {
         size_t index(lexicalCast<size_t>(buffer.substr(10 + 8 * i, 3), ok) - 1);
         if (!ok) {