mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

hdf5: fix CVE-2025-44905

Browse Source 
According to [1], hdf5 v1.14.6 was discovered to contain a heap buffer
overflow via the H5Z__filter_scaleoffset function.

Backport patch [2] from upstream to fix CVE-2025-44905

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-44905
[2] https://github.com/HDFGroup/hdf5/commit/42588aeba786a121fec1fbad72cf39d8f60a4983

Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Libo Chen
2026-04-10 15:05:03 +08:00
committed by Anuj Mittal
parent c96f578f10
commit 69fcb4d4b1
2 changed files with 47 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/hdf5/files/CVE-2025-44905.patch
+46
View File
@@ -0,0 +1,46 @@
From d7ed737287ef2ecc6efd006fa11c3f784cdbdba6 Mon Sep 17 00:00:00 2001
From: Libo Chen <libo.chen.cn@windriver.com>
Date: Fri, 30 Jan 2026 14:37:09 +0800
Subject: [PATCH] H5Zscaleoffset: add buffer size check to prevent
out-of-bounds reads
Adds a buffer size check in H5Z__filter_scaleoffset to prevent out-of-bounds reads with malformed HDF5 files.
Fixes CVE-2025-44905.
CVE: CVE-2025-44905
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/42588aeba786a121fec1fbad72cf39d8f60a4983]
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
---
src/H5Zscaleoffset.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/H5Zscaleoffset.c b/src/H5Zscaleoffset.c
index 048344b..fbf12d6 100644
--- a/src/H5Zscaleoffset.c
+++ b/src/H5Zscaleoffset.c
@@ -1205,6 +1205,9 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu
unsigned minval_size = 0;
minbits = 0;
+ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5, (unsigned char *)*buf + *buf_size - 1))
+ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short");
+
for (i = 0; i < 4; i++) {
minbits_mask = ((unsigned char *)*buf)[i];
minbits_mask <<= i * 8;
@@ -1220,6 +1223,9 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu
minval_size = sizeof(unsigned long long) <= ((unsigned char *)*buf)[4] ? sizeof(unsigned long long)
: ((unsigned char *)*buf)[4];
minval = 0;
+ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size,
+ (unsigned char *)*buf + *buf_size - 1))
+ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short");
for (i = 0; i < minval_size; i++) {
minval_mask = ((unsigned char *)*buf)[5 + i];
minval_mask <<= i * 8;
--
2.34.1
meta-oe/recipes-support/hdf5/hdf5_1.14.4-3.bb
+1
View File
@@ -26,6 +26,7 @@ SRC_URI = " \
file://CVE-2025-2926.patch \
file://CVE-2025-2153.patch \
file://CVE-2025-2310.patch \
file://CVE-2025-44905.patch \
"
SRC_URI[sha256sum] = "019ac451d9e1cf89c0482ba2a06f07a46166caf23f60fea5ef3c37724a318e03"