mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-15 06:17:16 +00:00
Devansh Patel
6bfefb82b3
This patch backports the upstream fix first released in HDF5 2.1.0. The upstream fix commit is referenced in [1], and the public advisory is referenced in [2]. Although the advisory [2] lists HDF5 2.0.0 as affected, NVD [3] also marks versions before 2.0.0 as affected, and its CPE configuration marks versions before 2.1.0 as vulnerable. Scarthgap's HDF5 1.14.4-3 H5T_ARRAY decoder in src/H5Odtype.c computes the array element count and decodes the parent datatype without checking for multiplication overflow or verifying that the stored datatype size matches the element size multiplied by the element count. The vulnerable code path is therefore present in 1.14.4-3, so this backport is applicable. [1] https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6 [2] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f [3] https://nvd.nist.gov/vuln/detail/CVE-2026-26197 Signed-off-by: Devansh Patel <devanshp@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Collection of layers for the OE-core universe
Main layer maintainer: Anuj Mittal anuj.mittal@oss.qualcomm.com
This repository is a collection of layers to suppliment OE-Core with additional packages, Each layer have designated maintainer Please see the respective READMEs in the layer subdirectories