diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch new file mode 100644 index 0000000000..3f0a8d69d5 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch @@ -0,0 +1,172 @@ +From 78672660618de8cca7c804f465886af02a89e79b Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Wed, 21 Oct 2026 13:52:39 -0500 +Subject: [PATCH] Bound filter header reads to the stored chunk length (#6585) + +* bound scaleoffset and fletcher32 reads to the chunk buffer + +* Bound filter header reads to the stored chunk length + +This PR is an expansion of #6579. + +The scaleoffset bounds checks measured against *buf_size, the size of the +chunk buffer, rather than nbytes, the number of bytes the pipeline read from +the file. H5D__chunk_lock() sizes a filtered chunk buffer to MAX(stored size, +unfiltered size) so filters have room to expand into, and fills only the +stored bytes, so the buffer is routinely longer than the data in it. A +truncated chunk therefore passed the header check and decompressed out of the +uninitialized remainder of the allocation, returning unrelated heap contents +as dataset data. Because the reads stay inside the allocation, the address +sanitizer does not see them. + +This PR switches every read-side check in H5Z__filter_scaleoffset() +to bound against nbytes and pass the stored length to +H5Z__scaleoffset_decompress(). + +Similar short-chunk checks are added to szip and fletcher32. + +The direct chunk test has been extended to cover a chunk whose unfiltered size is +larger than the bytes stored for it, and to cover szip. + +* Correct potential invalid pointer usage + +* update CHANGELOG + +* Update CHANGELOG comment + +* Guard scaleoffset output size against multiplication overflow + +--------- + +Co-authored-by: Nayyar +Co-authored-by: Larry Knox + +CVE: CVE-2026-120754 CVE-2026-120755 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/cdb13c4de9c7edbbae180f384e2e610a3b3cf185] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Zfletcher32.c | 13 +++++++------ + src/H5Zscaleoffset.c | 15 +++++++++++---- + src/H5Zszip.c | 18 ++++++++++++++---- + 3 files changed, 32 insertions(+), 14 deletions(-) + +diff --git a/src/H5Zfletcher32.c b/src/H5Zfletcher32.c +index b89724ad0a3..5ef3b04cbcf 100644 +--- a/src/H5Zfletcher32.c ++++ b/src/H5Zfletcher32.c +@@ -62,13 +62,14 @@ H5Z__filter_fletcher32(unsigned flags, size_t H5_ATTR_UNUSED cd_nelmts, + assert(sizeof(uint32_t) >= 4); + + if (flags & H5Z_FLAG_REVERSE) { /* Read */ +- /* A Fletcher32-filtered buffer must contain at least the trailing +- * checksum. Reject anything smaller to avoid a size_t underflow +- * when computing the data length. ++ /* The checksum is stored at the end of the chunk, so anything shorter ++ * than the checksum itself makes the length arithmetic below wrap. A ++ * chunk of exactly FLETCHER_LEN bytes holds no data and would return a ++ * filtered size of zero, which the pipeline reports as a filter failure, ++ * so reject it here where the reason can be stated. + */ +- if (nbytes < FLETCHER_LEN) +- HGOTO_ERROR(H5E_STORAGE, H5E_OVERFLOW, 0, +- "fletcher32 filter input buffer too small to contain checksum"); ++ if (nbytes <= FLETCHER_LEN) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + + /* Do checksum if it's enabled for read; otherwise skip it + * to save performance. */ +diff --git a/src/H5Zscaleoffset.c b/src/H5Zscaleoffset.c +index d39b4f40403..d506e5203a0 100644 +--- a/src/H5Zscaleoffset.c ++++ b/src/H5Zscaleoffset.c +@@ -1205,10 +1205,18 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu + unsigned long long minval_mask = 0; + unsigned minval_size = 0; + +- minbits = 0; +- if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5, (unsigned char *)*buf + *buf_size - 1)) ++ /* Bound every read below by nbytes rather than *buf_size. The caller may ++ * provide a buffer larger than the data it holds, so restrict the read ++ * to the valid nbytes. ++ */ ++ /* The minbits and minval-size fields are the first five bytes of the ++ * stream, so validate that length before deriving an end-of-buffer ++ * pointer from nbytes ++ */ ++ if (nbytes < 5) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + ++ minbits = 0; + for (i = 0; i < 4; i++) { + minbits_mask = ((unsigned char *)*buf)[i]; + minbits_mask <<= i * 8; +@@ -1224,8 +1232,7 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu + minval_size = sizeof(unsigned long long) <= ((unsigned char *)*buf)[4] ? sizeof(unsigned long long) + : ((unsigned char *)*buf)[4]; + minval = 0; +- if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size, +- (unsigned char *)*buf + *buf_size - 1)) ++ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size, (unsigned char *)*buf + nbytes - 1)) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + for (i = 0; i < minval_size; i++) { + minval_mask = ((unsigned char *)*buf)[5 + i]; +diff --git a/src/H5Zszip.c b/src/H5Zszip.c +index 9b37035374f..dd6c3619873 100644 +--- a/src/H5Zszip.c ++++ b/src/H5Zszip.c +@@ -28,6 +28,9 @@ + #include "szlib.h" + #endif + ++/* Size of the uncompressed-length header stored in front of the szip stream */ ++#define SZIP_HEADER_LEN 4 ++ + /* Local function prototypes */ + static htri_t H5Z__can_apply_szip(hid_t dcpl_id, hid_t type_id, hid_t space_id); + static herr_t H5Z__set_local_szip(hid_t dcpl_id, hid_t type_id, hid_t space_id); +@@ -284,6 +287,13 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + uint32_t stored_nalloc; /* Number of bytes the compressed block will expand into */ + size_t nalloc; /* Number of bytes the compressed block will expand into */ + ++ /* The uncompressed length is stored in front of the compressed stream, so ++ * a chunk shorter than that header makes the length arithmetic below wrap. ++ * A chunk of exactly SZIP_HEADER_LEN bytes holds no compressed data. ++ */ ++ if (nbytes <= SZIP_HEADER_LEN) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); ++ + /* Get the size of the uncompressed buffer */ + newbuf = (unsigned char *)(*buf); + UINT32DECODE(newbuf, stored_nalloc); +@@ -295,7 +305,7 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + + /* Decompress the buffer */ + size_out = nalloc; +- if (SZ_BufftoBuffDecompress(outbuf, &size_out, newbuf, nbytes - 4, &sz_param) != SZ_OK) ++ if (SZ_BufftoBuffDecompress(outbuf, &size_out, newbuf, nbytes - SZIP_HEADER_LEN, &sz_param) != SZ_OK) + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "szip_filter: decompression failed"); + assert(size_out == nalloc); + +@@ -313,7 +323,7 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + unsigned char *dst = NULL; /* Temporary pointer to new output buffer */ + + /* Allocate space for the compressed buffer & header (assume data won't get bigger) */ +- if (NULL == (dst = outbuf = (unsigned char *)H5MM_malloc(nbytes + 4))) ++ if (NULL == (dst = outbuf = (unsigned char *)H5MM_malloc(nbytes + SZIP_HEADER_LEN))) + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "unable to allocate szip destination buffer"); + + /* Encode the uncompressed length */ +@@ -332,8 +342,8 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + /* Set return values */ + *buf = outbuf; + outbuf = NULL; +- *buf_size = nbytes + 4; +- ret_value = size_out + 4; ++ *buf_size = nbytes + SZIP_HEADER_LEN; ++ ret_value = size_out + SZIP_HEADER_LEN; + } + + done: diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 99f1eebec2..7642beb675 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -25,6 +25,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ file://CVE-2026-19023-CVE-2026-19024.patch \ file://CVE-2026-120689.patch \ + file://CVE-2026-120754-CVE-2026-120755.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"