mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-28 23:30:21 +00:00
Code Issues Projects Releases Wiki Activity

hdf5: Fix CVE-2026-26197

Browse Source 
This patch applies the upstream HDF5 2.1.0 backport for
CVE-2026-26197. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6
[2] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Devansh Patel
2026-08-04 22:09:22 -07:00
committed by Khem Raj
parent 12ff50b949
commit f4cb6efc4d
2 changed files with 71 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/hdf5/files/CVE-2026-26197.patch
+70
View File
@@ -0,0 +1,70 @@
From 7a9f34e150beb688397d3f562d0f6ed1f9cd0e60 Mon Sep 17 00:00:00 2001
From: bmribler <39579120+bmribler@users.noreply.github.com>
Date: Tue, 3 Feb 2026 16:26:51 -0500
Subject: [PATCH] Validate datatype size for consistency (#6173)
User report:
When a file is corrupted such that an array datatype's size, the
number of elements, and the element size are not in agreement, it can
trigger an out of bounds read.
(private GH issue: GHSA-gh44-7wpq-622f)
Added a validation to ensure the above are in agreement.
CVE: CVE-2026-26197
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6]
Backport Changes:
- Omitted release_docs/CHANGELOG.md because its HDF5 2.1.0 release
context does not apply to the 2.0.0 backport.
(cherry picked from commit 8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
src/H5Odtype.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/H5Odtype.c b/src/H5Odtype.c
index f53f608ee..d6405cdb8 100644
--- a/src/H5Odtype.c
+++ b/src/H5Odtype.c
@@ -774,7 +774,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "invalid datatype location");
break;
- case H5T_ARRAY:
+ case H5T_ARRAY: {
+ size_t expected_size; /* for validating array datatype size consistency */
/*
* Array datatypes...
*/
@@ -816,6 +817,22 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
if (H5O__dtype_decode_helper(ioflags, pp, dt->shared->parent, skip, p_end) < 0)
HGOTO_ERROR(H5E_DATATYPE, H5E_CANTDECODE, FAIL, "unable to decode array parent type");
+ /* Check for multiplication overflow */
+ if (dt->shared->parent->shared->size > 0 &&
+ dt->shared->u.array.nelem > SIZE_MAX / dt->shared->parent->shared->size)
+ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL,
+ "array datatype size calculation would overflow");
+
+ expected_size = dt->shared->parent->shared->size * dt->shared->u.array.nelem;
+
+ /* Verify the stored size matches the calculated size */
+ if (dt->shared->size != expected_size)
+ HGOTO_ERROR(
+ H5E_DATATYPE, H5E_BADVALUE, FAIL,
+ "array datatype size mismatch: expected %zu (element_size=%zu * nelem=%zu), got %zu",
+ expected_size, dt->shared->parent->shared->size, dt->shared->u.array.nelem,
+ dt->shared->size);
+
/* Check if the parent of this array has a version greater than the
* array itself. */
H5O_DTYPE_CHECK_VERSION(dt, version, dt->shared->parent->shared->version, ioflags, "array", FAIL)
@@ -829,6 +846,7 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
if (dt->shared->parent->shared->force_conv == true)
dt->shared->force_conv = true;
break;
+ }
case H5T_COMPLEX: {
bool homogeneous;
meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+1
View File
@@ -17,6 +17,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
file://0002-Remove-suffix-shared-from-shared-library-name.patch \
file://0001-cmake-remove-build-flags.patch \
file://CVE-2026-26199.patch \
file://CVE-2026-26197.patch \
"
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"