mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-16 16:27:27 +00:00
Libo Chen
69fcb4d4b1
According to [1], hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. Backport patch [2] from upstream to fix CVE-2025-44905 [1] https://nvd.nist.gov/vuln/detail/CVE-2025-44905 [2] https://github.com/HDFGroup/hdf5/commit/42588aeba786a121fec1fbad72cf39d8f60a4983 Signed-off-by: Libo Chen <libo.chen.cn@windriver.com> Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
47 lines
1.9 KiB
Diff
47 lines
1.9 KiB
Diff
From d7ed737287ef2ecc6efd006fa11c3f784cdbdba6 Mon Sep 17 00:00:00 2001
|
|
From: Libo Chen <libo.chen.cn@windriver.com>
|
|
Date: Fri, 30 Jan 2026 14:37:09 +0800
|
|
Subject: [PATCH] H5Zscaleoffset: add buffer size check to prevent
|
|
out-of-bounds reads
|
|
|
|
Adds a buffer size check in H5Z__filter_scaleoffset to prevent out-of-bounds reads with malformed HDF5 files.
|
|
|
|
Fixes CVE-2025-44905.
|
|
|
|
CVE: CVE-2025-44905
|
|
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/42588aeba786a121fec1fbad72cf39d8f60a4983]
|
|
|
|
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
|
|
---
|
|
src/H5Zscaleoffset.c | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/src/H5Zscaleoffset.c b/src/H5Zscaleoffset.c
|
|
index 048344b..fbf12d6 100644
|
|
--- a/src/H5Zscaleoffset.c
|
|
+++ b/src/H5Zscaleoffset.c
|
|
@@ -1205,6 +1205,9 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu
|
|
unsigned minval_size = 0;
|
|
|
|
minbits = 0;
|
|
+ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5, (unsigned char *)*buf + *buf_size - 1))
|
|
+ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short");
|
|
+
|
|
for (i = 0; i < 4; i++) {
|
|
minbits_mask = ((unsigned char *)*buf)[i];
|
|
minbits_mask <<= i * 8;
|
|
@@ -1220,6 +1223,9 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu
|
|
minval_size = sizeof(unsigned long long) <= ((unsigned char *)*buf)[4] ? sizeof(unsigned long long)
|
|
: ((unsigned char *)*buf)[4];
|
|
minval = 0;
|
|
+ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size,
|
|
+ (unsigned char *)*buf + *buf_size - 1))
|
|
+ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short");
|
|
for (i = 0; i < minval_size; i++) {
|
|
minval_mask = ((unsigned char *)*buf)[5 + i];
|
|
minval_mask <<= i * 8;
|
|
--
|
|
2.34.1
|
|
|