mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-26 19:47:17 +00:00
Ankur Tyagi
81c0782d8f
Details https://nvd.nist.gov/vuln/detail/CVE-2025-2925 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
54 lines
2.8 KiB
Diff
54 lines
2.8 KiB
Diff
From 57a511958842f50cbf07b05262f2fe95e70c141b Mon Sep 17 00:00:00 2001
|
|
From: Glenn Song <43005495+glennsong09@users.noreply.github.com>
|
|
Date: Thu, 9 Oct 2025 14:48:55 -0500
|
|
Subject: [PATCH] Fix CVE-2025-2925 (#5739)
|
|
|
|
This PR fixes issue #5383, which was occurring due to actual_len + H5C_IMAGE_EXTRA_SPACE being 0. When realloc was called, it freed image, but gets sent to done before new_image can be assigned to image. Because the pointer for image isn't null, it attempts to free it here again, causing the double free to occur. This PR addresses Quincey's concern and fixes the issue while preserving new_image and image.
|
|
|
|
The bug was first reproduced using the fuzzer and the POC file from #5383. With this change, the double free no longer occurs.
|
|
|
|
CVE: CVE-2025-2925
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/4310c19608455c17a213383d07715efb2918defc]
|
|
|
|
(cherry picked from commit 4310c19608455c17a213383d07715efb2918defc)
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
src/H5Centry.c | 10 ++++++++++
|
|
1 file changed, 10 insertions(+)
|
|
|
|
diff --git a/src/H5Centry.c b/src/H5Centry.c
|
|
index 6883e89..bef93d8 100644
|
|
--- a/src/H5Centry.c
|
|
+++ b/src/H5Centry.c
|
|
@@ -1051,9 +1051,14 @@ H5C__load_entry(H5F_t *f,
|
|
*/
|
|
do {
|
|
if (actual_len != len) {
|
|
+ /* Verify that the length isn't a bad value */
|
|
+ if (len == 0)
|
|
+ HGOTO_ERROR(H5E_CACHE, H5E_BADVALUE, NULL, "len is a bad value");
|
|
+
|
|
if (NULL == (new_image = H5MM_realloc(image, len + H5C_IMAGE_EXTRA_SPACE)))
|
|
HGOTO_ERROR(H5E_CACHE, H5E_CANTALLOC, NULL, "image null after H5MM_realloc()");
|
|
image = (uint8_t *)new_image;
|
|
+
|
|
#if H5C_DO_MEMORY_SANITY_CHECKS
|
|
H5MM_memcpy(image + len, H5C_IMAGE_SANITY_VALUE, H5C_IMAGE_EXTRA_SPACE);
|
|
#endif /* H5C_DO_MEMORY_SANITY_CHECKS */
|
|
@@ -1104,10 +1109,15 @@ H5C__load_entry(H5F_t *f,
|
|
if (H5C__verify_len_eoa(f, type, addr, &actual_len, true) < 0)
|
|
HGOTO_ERROR(H5E_CACHE, H5E_BADVALUE, NULL, "actual_len exceeds EOA");
|
|
|
|
+ /* Verify that the length isn't 0 */
|
|
+ if (actual_len == 0)
|
|
+ HGOTO_ERROR(H5E_CACHE, H5E_BADVALUE, NULL, "actual_len is a bad value");
|
|
+
|
|
/* Expand buffer to new size */
|
|
if (NULL == (new_image = H5MM_realloc(image, actual_len + H5C_IMAGE_EXTRA_SPACE)))
|
|
HGOTO_ERROR(H5E_CACHE, H5E_CANTALLOC, NULL, "image null after H5MM_realloc()");
|
|
image = (uint8_t *)new_image;
|
|
+
|
|
#if H5C_DO_MEMORY_SANITY_CHECKS
|
|
H5MM_memcpy(image + actual_len, H5C_IMAGE_SANITY_VALUE, H5C_IMAGE_EXTRA_SPACE);
|
|
#endif /* H5C_DO_MEMORY_SANITY_CHECKS */
|