mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-30 00:33:19 +00:00
Code Issues Projects Releases Wiki Activity

hdf5: Fix CVE-2026-26197

Browse Source 
This patch applies the upstream HDF5 2.1.0 backport for
CVE-2026-26197. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6
[2] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Devansh Patel
2026-08-04 22:09:31 -07:00
committed by Anuj Mittal
parent 78252bde18
commit 138d9ded13
2 changed files with 71 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/hdf5/files/CVE-2026-26197.patch
+70
View File
@@ -0,0 +1,70 @@
From fc4cead0fabba806750f0f90ec20ce2cf08f6027 Mon Sep 17 00:00:00 2001
From: bmribler <39579120+bmribler@users.noreply.github.com>
Date: Tue, 3 Feb 2026 16:26:51 -0500
Subject: [PATCH] Validate datatype size for consistency (#6173)
User report:
When a file is corrupted such that an array datatype's size, the
number of elements, and the element size are not in agreement, it can
trigger an out of bounds read.
(private GH issue: GHSA-gh44-7wpq-622f)
Added a validation to ensure the above are in agreement.
CVE: CVE-2026-26197
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6]
Backport Changes:
- Omitted release_docs/CHANGELOG.md because its HDF5 2.1.0 release
context does not apply to the 2.0.0 backport.
(cherry picked from commit 8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
src/H5Odtype.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/H5Odtype.c b/src/H5Odtype.c
index f53f608ee..d6405cdb8 100644
--- a/src/H5Odtype.c
+++ b/src/H5Odtype.c
@@ -774,7 +774,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "invalid datatype location");
break;
- case H5T_ARRAY:
+ case H5T_ARRAY: {
+ size_t expected_size; /* for validating array datatype size consistency */
/*
* Array datatypes...
*/
@@ -816,6 +817,22 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
if (H5O__dtype_decode_helper(ioflags, pp, dt->shared->parent, skip, p_end) < 0)
HGOTO_ERROR(H5E_DATATYPE, H5E_CANTDECODE, FAIL, "unable to decode array parent type");
+ /* Check for multiplication overflow */
+ if (dt->shared->parent->shared->size > 0 &&
+ dt->shared->u.array.nelem > SIZE_MAX / dt->shared->parent->shared->size)
+ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL,
+ "array datatype size calculation would overflow");
+
+ expected_size = dt->shared->parent->shared->size * dt->shared->u.array.nelem;
+
+ /* Verify the stored size matches the calculated size */
+ if (dt->shared->size != expected_size)
+ HGOTO_ERROR(
+ H5E_DATATYPE, H5E_BADVALUE, FAIL,
+ "array datatype size mismatch: expected %zu (element_size=%zu * nelem=%zu), got %zu",
+ expected_size, dt->shared->parent->shared->size, dt->shared->u.array.nelem,
+ dt->shared->size);
+
/* Check if the parent of this array has a version greater than the
* array itself. */
H5O_DTYPE_CHECK_VERSION(dt, version, dt->shared->parent->shared->version, ioflags, "array", FAIL)
@@ -829,6 +846,7 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
if (dt->shared->parent->shared->force_conv == true)
dt->shared->force_conv = true;
break;
+ }
case H5T_COMPLEX: {
bool homogeneous;
meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+1
View File
@@ -17,6 +17,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
file://0002-Remove-suffix-shared-from-shared-library-name.patch \
file://0001-cmake-remove-build-flags.patch \
file://CVE-2026-26199.patch \
file://CVE-2026-26197.patch \
"
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"