mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity

hdf5: Fix CVE-2026-17573

Browse Source 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-17573

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Yogita Urade authored and Anuj Mittal committed 2026-10-26 10:10:43 +05:30
1 parent a346f23e3a
commit f930afb284
2 files changed
+50
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch
+49
View File
@@ -0,0 +1,49 @@
From dd3080a58cc6bb86f3b34284399915da9e513262 Mon Sep 17 00:00:00 2001
From: jhendersonHDF <jhenderson@hdfgroup.org>
Date: Tue, 27 Jan 2026 05:55:38 -0600
Subject: [PATCH] Fix double-free issue in H5D__chunk_copy (#6160)
Fix double-free caused by loss of buffer pointer after re-allocation
CVE: CVE-2026-17573
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262]
Backport Changes:
- Omitted CHANGELOG.md file changes
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
(cherry picked from commit dd3080a58cc6bb86f3b34284399915da9e513262)
Signed-off-by: Yogita Urade <yurade@cisco.com>
---
src/H5Dchunk.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/src/H5Dchunk.c b/src/H5Dchunk.c
index 4727cc5d12..86340be16e 100644
--- a/src/H5Dchunk.c
+++ b/src/H5Dchunk.c
@@ -6809,7 +6809,7 @@ H5D__chunk_copy(H5F_t *f_src, H5O_storage_chunk_t *storage_src, H5O_layout_chunk
H5O_storage_chunk_t *storage_dst, const H5S_extent_t *ds_extent_src, H5T_t *dt_src,
const H5O_pline_t *pline_src, H5O_copy_t *cpy_info)
{
- H5D_chunk_it_ud3_t udata; /* User data for iteration callback */
+ H5D_chunk_it_ud3_t udata = {0}; /* User data for iteration callback */
H5D_chk_idx_info_t idx_info_dst; /* Dest. chunked index info */
H5D_chk_idx_info_t idx_info_src; /* Source chunked index info */
int sndims; /* Rank of dataspace */
@@ -6974,5 +6974,4 @@ H5D__chunk_copy(H5F_t *f_src, H5O_storage_chunk_t *storage_src, H5O_layout_chunk
/* Initialize the callback structure for the source */
- memset(&udata, 0, sizeof udata);
udata.common.layout = layout_src;
udata.common.storage = storage_src;
udata.file_src = f_src;
@@ -7024,3 +7023,4 @@ H5D__chunk_copy(H5F_t *f_src, H5O_storage_chunk_t *storage_src, H5O_layout_chunk
+done:
/* I/O buffers may have been re-allocated */
buf = udata.buf;
bkg = udata.bkg;
@@ -7029,2 +7029,1 @@ H5D__chunk_copy(H5F_t *f_src, H5O_storage_chunk_t *storage_src, H5O_layout_chunk
-done:
if (dt_dst && (H5T_close(dt_dst) < 0))
HDONE_ERROR(H5E_DATASET, H5E_CANTCLOSEOBJ, FAIL, "can't close temporary datatype");
if (dt_mem && (H5T_close(dt_mem) < 0))
meta-oe/recipes-support/hdf5/hdf5_1.14.4-3.bb
+1
View File
@@ -33,6 +33,7 @@ SRC_URI = " \
file://CVE-2026-26199.patch \
file://CVE-2026-26197.patch \
file://CVE-2026-17572.patch \
file://CVE-2026-17573.patch \
"
SRC_URI[sha256sum] = "019ac451d9e1cf89c0482ba2a06f07a46166caf23f60fea5ef3c37724a318e03"