mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-27 00:30:20 +00:00
Code Issues Projects Releases Wiki Activity

hdf5: patch CVE-2026-17573

Browse Source 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 07:52:01 +05:30
committed by Anuj Mittal
parent c279e9e688
commit f46990293c
2 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch
+53
View File
@@ -0,0 +1,53 @@
From 856e7f1dd23e466ebeab5e454a5891b12e188f6a Mon Sep 17 00:00:00 2001
From: jhendersonHDF <jhenderson@hdfgroup.org>
Date: Tue, 27 Jan 2026 05:55:38 -0600
Subject: [PATCH] Fix double-free issue in H5D__chunk_copy (#6160)
Fix double-free caused by loss of buffer pointer after re-allocation
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
CVE: CVE-2026-17573
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262]
Dropped changes to the CHANGELOG file.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/H5Dchunk.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/src/H5Dchunk.c b/src/H5Dchunk.c
index f2a0e85c03..5ff537ebde 100644
--- a/src/H5Dchunk.c
+++ b/src/H5Dchunk.c
@@ -7034,7 +7034,7 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
const H5S_extent_t *ds_extent_src, H5T_t *dt_src, const H5O_pline_t *pline_src,
H5O_copy_t *cpy_info)
{
- H5D_chunk_it_ud3_t udata; /* User data for iteration callback */
+ H5D_chunk_it_ud3_t udata = {0}; /* User data for iteration callback */
H5D_chk_idx_info_t idx_info_dst; /* Dest. chunked index info */
H5D_chk_idx_info_t idx_info_src; /* Source chunked index info */
int sndims; /* Rank of dataspace */
@@ -7202,7 +7202,6 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed for raw data chunk");
/* Initialize the callback structure for the source */
- memset(&udata, 0, sizeof udata);
udata.common.layout = &layout_src->u.chunk;
udata.common.storage = &layout_src->storage.u.chunk;
udata.file_src = f_src;
@@ -7253,11 +7252,11 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
} /* end for */
}
+done:
/* I/O buffers may have been re-allocated */
buf = udata.buf;
bkg = udata.bkg;
-done:
if (dt_dst && (H5T_close(dt_dst) < 0))
HDONE_ERROR(H5E_DATASET, H5E_CANTCLOSEOBJ, FAIL, "can't close temporary datatype");
if (dt_mem && (H5T_close(dt_mem) < 0))
meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+1
View File
@@ -19,6 +19,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
file://CVE-2026-26199.patch \
file://CVE-2026-26197.patch \
file://CVE-2026-17572.patch \
file://CVE-2026-17573.patch \
"
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"