mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-14 03:57:15 +00:00
hdf5: patch CVE-2026-19023 and CVE-2026-19024
Details: https://nvd.nist.gov/vuln/detail/cve-2026-19023 https://nvd.nist.gov/vuln/detail/cve-2026-19024 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and 
Anuj Mittal committed
1 parent
35efa73ce4
commit
c6a5d54405
2 files changed
+177
No files matched your search
@@ -0,0 +1,176 @@
|
||||
From e7e85949865b771b2b0b73ac1edaf54ce14cd894 Mon Sep 17 00:00:00 2001
|
||||
From: Matt L <124107509+mattjala@users.noreply.github.com>
|
||||
Date: Wed, 7 Oct 2026 11:03:55 -0500
|
||||
Subject: [PATCH] Fix CVEs related to vlen binary output and malformed fill
|
||||
values in h5dump (#6507)
|
||||
|
||||
* Fix h5dump SIGSEGVs on vlen binary output and malformed fill value
|
||||
|
||||
Fixes two crafted-file crashes in h5dump (GitHub issues #6486 and #6487).
|
||||
A third report (#6488) is the Fletcher32 checksum-length underflow already
|
||||
fixed for h5ls in PR #6497, so it is not addressed again here.
|
||||
|
||||
Issue #6486 (tools) - render_bin_output() SIGSEGV with "-b" on a
|
||||
variable-length string dataset. The H5T_STRING branch reused the local
|
||||
"size" variable both as the per-element stride and as the string length
|
||||
returned by strlen(), so after the first element the stride became that
|
||||
string's length and subsequent elements were read from misaligned
|
||||
addresses, dereferencing a garbage pointer. This affected any multi-element
|
||||
vlen-string dataset, not just crafted files. A separate str_len variable is
|
||||
now used for the write length so "size" stays the datatype stride. As this
|
||||
is a tools bug, the regression test is a tools test: tools/test/h5dump adds
|
||||
the tbinvlstr case (binary dump of a vlen-string dataset, file
|
||||
tbinvlstr.h5, generated by h5dumpgentest.c/gent_binvlstr), which crashes on
|
||||
develop and passes with the fix.
|
||||
|
||||
Issue #6487 (library) - H5Pget_fill_value() SIGSEGV via H5T_path_find().
|
||||
A crafted version-1/2 fill value message can have "fill defined" set with a
|
||||
negative size field; H5O_fill_old_decode() leaves fill.size negative and
|
||||
fill.buf/type NULL instead of normalizing to the "undefined" sentinel.
|
||||
That value is neither 0 nor -1, so H5P_get_fill_value() fell through to
|
||||
H5T_path_find() with a NULL source type and crashed. H5P_get_fill_value()
|
||||
now rejects a NULL fill datatype and returns an error, keeping the dataset
|
||||
itself readable. h5dump's XML fill-value renderer (xml_dump_fill_value) is
|
||||
also hardened: it checks the buffer allocation and the H5Pget_fill_value()
|
||||
return value and emits an empty fill value element instead of dereferencing
|
||||
an unallocated or unretrievable buffer.
|
||||
|
||||
Regression test (library): test/fillval.c test_bad_fill_value() reads a
|
||||
crafted file (generated by test/gen_bad_fill.c, committed as
|
||||
test/testfiles/bad_fill_value.h5) and verifies that the dataset data is
|
||||
still readable while H5Pget_fill_value() fails cleanly instead of crashing.
|
||||
|
||||
Verified: both PoCs exit cleanly with the fix (SIGSEGV without it); the
|
||||
committed fixtures crash the pre-fix library/tools and pass post-fix; the
|
||||
fillval suite, the new tbinvlstr h5dump test, and the non-XML h5dump suite
|
||||
pass.
|
||||
|
||||
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||||
|
||||
* Update CHANGELOG to list CVEs/GH issues
|
||||
|
||||
* Renumber tbinvlstr.h5 generator macro to FILE114
|
||||
|
||||
---------
|
||||
|
||||
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
|
||||
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
|
||||
|
||||
CVE: CVE-2026-19023 CVE-2026-19024
|
||||
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/cfcd7fe7421cc94e0527d043f2d1b271986e7b09]
|
||||
|
||||
Dropped changes to the test and CHANGELOG file.
|
||||
|
||||
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
||||
---
|
||||
src/H5Pdcpl.c | 7 +++++++
|
||||
tools/lib/h5tools.c | 9 ++++++---
|
||||
tools/src/h5dump/h5dump_xml.c | 33 ++++++++++++++++++++++++++++-----
|
||||
3 files changed, 41 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/src/H5Pdcpl.c b/src/H5Pdcpl.c
|
||||
index 2317c317f73..a1a33d52c7b 100644
|
||||
--- a/src/H5Pdcpl.c
|
||||
+++ b/src/H5Pdcpl.c
|
||||
@@ -3207,6 +3207,13 @@ H5P_get_fill_value(H5P_genplist_t *plist, const H5T_t *type, void *value /*out*/
|
||||
HGOTO_DONE(SUCCEED);
|
||||
} /* end if */
|
||||
|
||||
+ /*
|
||||
+ * A fill value with a nonzero size must have an associated datatype in
|
||||
+ * order to be converted to the destination type.
|
||||
+ */
|
||||
+ if (NULL == fill.type)
|
||||
+ HGOTO_ERROR(H5E_PLIST, H5E_CANTGET, FAIL, "fill value has no datatype");
|
||||
+
|
||||
/*
|
||||
* Can we convert between the source and destination datatypes?
|
||||
*/
|
||||
diff --git a/tools/lib/h5tools.c b/tools/lib/h5tools.c
|
||||
index b1a2aa0de4c..3e028504f7c 100644
|
||||
--- a/tools/lib/h5tools.c
|
||||
+++ b/tools/lib/h5tools.c
|
||||
@@ -1825,24 +1825,27 @@ render_bin_output(FILE *stream, hid_t container, hid_t tid, void *_mem, hsize_t
|
||||
H5T_str_t pad;
|
||||
char *s = NULL;
|
||||
unsigned char tempuchar;
|
||||
+ size_t str_len; /* # of bytes to write for this element */
|
||||
|
||||
H5TOOLS_DEBUG("H5T_STRING");
|
||||
pad = H5Tget_strpad(tid);
|
||||
|
||||
for (block_index = 0; block_index < block_nelmts; block_index++) {
|
||||
+ /* Advance by the datatype size */
|
||||
mem = ((unsigned char *)_mem) + block_index * size;
|
||||
|
||||
if (H5Tis_variable_str(tid)) {
|
||||
s = *(char **)((void *)mem);
|
||||
if (s != NULL)
|
||||
- size = strlen(s);
|
||||
+ str_len = strlen(s);
|
||||
else
|
||||
H5TOOLS_THROW((-1), "NULL string");
|
||||
}
|
||||
else {
|
||||
- s = (char *)mem;
|
||||
+ s = (char *)mem;
|
||||
+ str_len = size;
|
||||
}
|
||||
- for (i = 0; i < size && (s[i] || pad != H5T_STR_NULLTERM); i++) {
|
||||
+ for (i = 0; i < str_len && (s[i] || pad != H5T_STR_NULLTERM); i++) {
|
||||
memcpy(&tempuchar, &s[i], sizeof(unsigned char));
|
||||
if (1 != fwrite(&tempuchar, sizeof(unsigned char), 1, stream))
|
||||
H5TOOLS_THROW((-1), "fwrite failed");
|
||||
diff --git a/tools/src/h5dump/h5dump_xml.c b/tools/src/h5dump/h5dump_xml.c
|
||||
index f1a34870f4a..6f3e00a27df 100644
|
||||
--- a/tools/src/h5dump/h5dump_xml.c
|
||||
+++ b/tools/src/h5dump/h5dump_xml.c
|
||||
@@ -3534,8 +3534,9 @@ xml_dump_fill_value(hid_t dcpl, hid_t type)
|
||||
hid_t n_type = H5I_INVALID_HID;
|
||||
void *buf;
|
||||
char *name;
|
||||
- h5tools_str_t buffer; /* string into which to render */
|
||||
- h5tools_context_t ctx; /* print context */
|
||||
+ herr_t fill_ret = FAIL; /* status of retrieving the fill value */
|
||||
+ h5tools_str_t buffer; /* string into which to render */
|
||||
+ h5tools_context_t ctx; /* print context */
|
||||
h5tool_format_t *outputformat = &xml_dataformat;
|
||||
h5tool_format_t string_dataformat;
|
||||
hsize_t curr_pos = 0; /* total data element position */
|
||||
@@ -3593,11 +3594,33 @@ xml_dump_fill_value(hid_t dcpl, hid_t type)
|
||||
n_type = type;
|
||||
|
||||
space = H5Tget_size(n_type);
|
||||
- buf = malloc((size_t)space);
|
||||
+ /* Zero-initialize so a partially-filled buffer never contains
|
||||
+ * uninitialized memory for the rendering code below. */
|
||||
+ buf = calloc((size_t)space, 1);
|
||||
+
|
||||
+ /* Retrieve the fill value. This can fail on a corrupted or crafted file
|
||||
+ * whose fill value has no datatype. Any errors are suppressed and handled
|
||||
+ * later. */
|
||||
+ if (buf != NULL) {
|
||||
+ H5E_BEGIN_TRY
|
||||
+ {
|
||||
+ fill_ret = H5Pget_fill_value(dcpl, n_type, buf);
|
||||
+ }
|
||||
+ H5E_END_TRY
|
||||
+ }
|
||||
|
||||
- H5Pget_fill_value(dcpl, n_type, buf);
|
||||
+ if (buf == NULL || fill_ret < 0) {
|
||||
+ /* No usable fill value: emit an empty element rather than
|
||||
+ * dereferencing an unallocated or unretrievable buffer. */
|
||||
+ ctx.need_prefix = true;
|
||||
|
||||
- if (H5Tget_class(n_type) == H5T_REFERENCE) {
|
||||
+ /* Render the element */
|
||||
+ h5tools_str_reset(&buffer);
|
||||
+ h5tools_str_append(&buffer, "<%sNoData />", xmlnsprefix);
|
||||
+ h5tools_render_element(rawoutstream, outputformat, &ctx, &buffer, &curr_pos,
|
||||
+ (size_t)outputformat->line_ncols, (hsize_t)0, (hsize_t)0);
|
||||
+ }
|
||||
+ else if (H5Tget_class(n_type) == H5T_REFERENCE) {
|
||||
const char *path = lookup_ref_path(*(H5R_ref_t *)buf);
|
||||
|
||||
ctx.need_prefix = true;
|
||||
@@ -23,6 +23,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
|
||||
file://CVE-2026-17574.patch \
|
||||
file://CVE-2026-19025.patch \
|
||||
file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \
|
||||
file://CVE-2026-19023-CVE-2026-19024.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"
|
||||
|
||||
|
||||
Reference in new issue
Block a user