Description: Fix printing variables from MAT v5 file
 Fixes CVE-2019-9037.
Origin: backport, https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
Bug: https://github.com/tbeu/matio/issues/103
Bug-Debian: https://bugs.debian.org/924185
Last-Update: 2019-03-12
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- a/src/mat.c
+++ b/src/mat.c
@@ -1580,7 +1580,7 @@ Mat_VarPrint( matvar_t *matvar, int prin
        "16-bit, unsigned integer array","32-bit, signed integer array",
        "32-bit, unsigned integer array","64-bit, signed integer array",
        "64-bit, unsigned integer array"};
-    const char *data_type_desc[23] = {"Unknown","8-bit, signed integer",
+    const char *data_type_desc[25] = {"Unknown","8-bit, signed integer",
        "8-bit, unsigned integer","16-bit, signed integer",
        "16-bit, unsigned integer","32-bit, signed integer",
        "32-bit, unsigned integer","IEEE 754 single-precision","RESERVED",
@@ -1588,8 +1588,8 @@ Mat_VarPrint( matvar_t *matvar, int prin
        "64-bit, signed integer","64-bit, unsigned integer", "Matlab Array",
        "Compressed Data","Unicode UTF-8 Encoded Character Data",
        "Unicode UTF-16 Encoded Character Data",
-       "Unicode UTF-32 Encoded Character Data","","String","Cell Array",
-       "Structure"};
+       "Unicode UTF-32 Encoded Character Data","RESERVED","String","Cell Array",
+       "Structure","Array","Function"};
 
     if ( matvar == NULL )
         return;
--- a/tools/matdump.c
+++ b/tools/matdump.c
@@ -754,7 +754,6 @@ print_default(matvar_t *matvar)
             break;
         case MAT_C_STRUCT:
         {
-            matvar_t **fields = (matvar_t **)matvar->data;
             int        nfields;
             int        i;
             size_t     nmemb;
@@ -780,8 +779,12 @@ print_default(matvar_t *matvar)
             } else if ( nfields > 0 && nmemb > 0 ) {
                 Mat_Message("Fields[%d] {", nfields);
                 indent++;
-                for ( i = 0; i < nfields*nmemb; i++ )
-                    print_default(fields[i]);
+                {
+                    matvar_t **fields = (matvar_t **)matvar->data;
+                    if ( NULL != fields )
+                        for ( i = 0; i < nfields*nmemb; i++ )
+                            print_default(fields[i]);
+                }
                 indent--;
                 Mat_Message("}");
             }
@@ -789,7 +792,6 @@ print_default(matvar_t *matvar)
         }
         case MAT_C_CELL:
         {
-            matvar_t **cells = (matvar_t **)matvar->data;
             size_t     ncells;
             int        i;
 
@@ -804,8 +806,12 @@ print_default(matvar_t *matvar)
             Mat_Message("Class Type: Cell Array");
             Mat_Message("{");
             indent++;
-            for ( i = 0; i < ncells; i++ )
-                print_default(cells[i]);
+            {
+                matvar_t **cells = (matvar_t **)matvar->data;
+                if ( NULL != cells )
+                    for ( i = 0; i < ncells; i++ )
+                        print_default(cells[i]);
+            }
             indent--;
             Mat_Message("}");
             break;