From 08221d912df460f346f5ca5a0dfd9827b34e83c7 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 6 Nov 2026 09:05:46 +1300 Subject: [PATCH] hdf5: patch CVE-2026-120689 Details: https://nvd.nist.gov/vuln/detail/cve-2026-120689 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj --- .../hdf5/files/CVE-2026-120689.patch | 60 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch new file mode 100644 index 0000000000..dd9e9374ac --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch @@ -0,0 +1,60 @@ +From 0472315404dc03d0e89eec4513eb80930f9b176e Mon Sep 17 00:00:00 2001 +From: PGZXB <420254146@qq.com> +Date: Fri, 9 Oct 2026 02:52:55 +0800 +Subject: [PATCH] Fix StackOverflow when calling `H5Gget_info` (#6685) + +Verify B-tree node level when an expected level value is provided + +(cherry picked from commit 5933130b610c7bd6e66fe93c2798b97e3f3188c8) + +CVE: CVE-2026-120689 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/5933130b610c7bd6e66fe93c2798b97e3f3188c8] + +Signed-off-by: Ankur Tyagi +--- + release_docs/CHANGELOG.md | 6 ++++++ + src/H5B.c | 14 ++++++++++++++ + 2 files changed, 20 insertions(+) + +diff --git a/release_docs/CHANGELOG.md b/release_docs/CHANGELOG.md +index c181f174bbb..b5c99cd4b16 100644 +--- a/release_docs/CHANGELOG.md ++++ b/release_docs/CHANGELOG.md +@@ -778,6 +778,12 @@ Added Fortran wrapper `h5fdsubfiling_get_file_mapping_f()` for the subfiling fil + + A malformed HDF5 file could have an attribute with a recorded name length of zero.This would lead to an overflow and an invalid memory access. An integrity check has been added to detect this case and safely stop file decoding. + ++### Fixed a stack overflow when iterating a corrupted B-tree ++ ++ `H5B__iterate_helper()` now verifies that a B-tree node it has just protected has the level the traversal expects, when the expected level is known. The equivalent check in `H5B__cache_deserialize()` only runs when a node is first loaded into the metadata cache, so a corrupted B-tree whose child pointer revisits a node that is already cached (for example, a node that points to itself) could bypass that check and recurse without bound until the stack was exhausted. Such a file is now rejected with an error instead of crashing. This was observed through `H5Gget_info()`. ++ ++ Fixes GitHub issue #6403 ++ + ## Java Library + + ### Renamed the Callbacks.java file to H5Callbacks.java +diff --git a/src/H5B.c b/src/H5B.c +index c9571708b73..4c6b1a55480 100644 +--- a/src/H5B.c ++++ b/src/H5B.c +@@ -1140,6 +1140,20 @@ H5B__iterate_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, int exp_lev + if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG))) + HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, H5_ITER_ERROR, "unable to load B-tree node"); + ++ /* Check for a corrupted B-tree node. If the caller has told us what ++ * level to expect, verify that the node we just protected actually has ++ * that level. This check must be performed here rather than relying ++ * solely on the equivalent check in H5B__cache_deserialize, because ++ * that deserialize callback only runs when a node is first loaded into ++ * the metadata cache. A corrupted B-tree whose child pointer revisits ++ * a node that is already cached (e.g. a node that points to itself) ++ * bypasses the deserialize callback entirely, so without this check the ++ * recursion below would never terminate and would overflow the stack. ++ */ ++ if (exp_level != H5B_UNKNOWN_NODELEVEL && bt->level != (unsigned)exp_level) ++ HGOTO_ERROR(H5E_BTREE, H5E_BADVALUE, H5_ITER_ERROR, ++ "B-tree node level is not as expected, possibly corrupted"); ++ + /* Iterate over node's children */ + for (u = 0; u < bt->nchildren && ret_value == H5_ITER_CONT; u++) { + if (bt->level > 0) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index b8e5101e41..99f1eebec2 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -24,6 +24,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-19025.patch \ file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ file://CVE-2026-19023-CVE-2026-19024.patch \ + file://CVE-2026-120689.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"