hdf5: patch CVE-2026-120689

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120689

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch

@@ -0,0 +1,60 @@
+From 0472315404dc03d0e89eec4513eb80930f9b176e Mon Sep 17 00:00:00 2001
+From: PGZXB <420254146@qq.com>
+Date: Fri, 9 Oct 2026 02:52:55 +0800
+Subject: [PATCH] Fix StackOverflow when calling `H5Gget_info` (#6685)
+
+Verify B-tree node level when an expected level value is provided
+
+(cherry picked from commit 5933130b610c7bd6e66fe93c2798b97e3f3188c8)
+
+CVE: CVE-2026-120689
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/5933130b610c7bd6e66fe93c2798b97e3f3188c8]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ release_docs/CHANGELOG.md |  6 ++++++
+ src/H5B.c                 | 14 ++++++++++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/release_docs/CHANGELOG.md b/release_docs/CHANGELOG.md
+index c181f174bbb..b5c99cd4b16 100644
+--- a/release_docs/CHANGELOG.md
++++ b/release_docs/CHANGELOG.md
+@@ -778,6 +778,12 @@ Added Fortran wrapper `h5fdsubfiling_get_file_mapping_f()` for the subfiling fil
+ 
+    A malformed HDF5 file could have an attribute with a recorded name length of zero.This would lead to an overflow and an invalid memory access. An integrity check has been added to detect this case and safely stop file decoding.
+ 
++### Fixed a stack overflow when iterating a corrupted B-tree
++
++   `H5B__iterate_helper()` now verifies that a B-tree node it has just protected has the level the traversal expects, when the expected level is known. The equivalent check in `H5B__cache_deserialize()` only runs when a node is first loaded into the metadata cache, so a corrupted B-tree whose child pointer revisits a node that is already cached (for example, a node that points to itself) could bypass that check and recurse without bound until the stack was exhausted. Such a file is now rejected with an error instead of crashing. This was observed through `H5Gget_info()`.
++
++   Fixes GitHub issue #6403
++
+ ## Java Library
+ 
+ ### Renamed the Callbacks.java file to H5Callbacks.java
+diff --git a/src/H5B.c b/src/H5B.c
+index c9571708b73..4c6b1a55480 100644
+--- a/src/H5B.c
++++ b/src/H5B.c
+@@ -1140,6 +1140,20 @@ H5B__iterate_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, int exp_lev
+     if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG)))
+         HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, H5_ITER_ERROR, "unable to load B-tree node");
+ 
++    /* Check for a corrupted B-tree node.  If the caller has told us what
++     * level to expect, verify that the node we just protected actually has
++     * that level.  This check must be performed here rather than relying
++     * solely on the equivalent check in H5B__cache_deserialize, because
++     * that deserialize callback only runs when a node is first loaded into
++     * the metadata cache.  A corrupted B-tree whose child pointer revisits
++     * a node that is already cached (e.g. a node that points to itself)
++     * bypasses the deserialize callback entirely, so without this check the
++     * recursion below would never terminate and would overflow the stack.
++     */
++    if (exp_level != H5B_UNKNOWN_NODELEVEL && bt->level != (unsigned)exp_level)
++        HGOTO_ERROR(H5E_BTREE, H5E_BADVALUE, H5_ITER_ERROR,
++                    "B-tree node level is not as expected, possibly corrupted");
++
+     /* Iterate over node's children */
+     for (u = 0; u < bt->nchildren && ret_value == H5_ITER_CONT; u++) {
+         if (bt->level > 0)

meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb

@@ -24,6 +24,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
            file://CVE-2026-19025.patch \
            file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \
            file://CVE-2026-19023-CVE-2026-19024.patch \
+           file://CVE-2026-120689.patch \
            "
 SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"