According to [1], A vulnerability has been found in HDF5 1.14.6 and
classified as problematic. Affected by this vulnerability is the function
H5G__node_cmp3 of the file src/H5Gnode.c. The manipulation leads to
stack-based buffer overflow. It is possible to launch the attack on the
local host. The exploit has been disclosed to the public and may be used.
Backport patch [2] from upstream to fix CVE-2025-6857
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-6857
[2] a8ceb1d95b
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
According to [1], A vulnerability, which was classified as critical, was
found in HDF5 1.14.6. This affects the function
H5Z__scaleoffset_decompress_one_byte of the component Scale-Offset Filter.
The manipulation leads to heap-based buffer overflow. An attack has to be
approached locally. The exploit has been disclosed to the public and may be
used. The vendor plans to fix this issue in an upcoming release.
Backport patch [2] from upstream to fix CVE-2025-2308
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-2308
[2] 2ce7fdc4cf
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
According to [1], A vulnerability has been found in HDF5 1.14.6 and
classified as critical. This vulnerability affects the function
H5T__bit_copy of the component Type Conversion Logic. The manipulation
leads to heap-based buffer overflow. Local access is required to approach
this attack. The exploit has been disclosed to the public and may be used.
The real existence of this vulnerability is still doubted at the moment.
The vendor plans to fix this issue in an upcoming release.
Backport patch [2] from upstream to fix CVE-2025-2309
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-2309
[2] 9d90b21ef5
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
According to [1], hdf5 v1.14.6 was discovered to contain a heap buffer
overflow via the H5Z__filter_scaleoffset function.
Backport patch [2] from upstream to fix CVE-2025-44905
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-44905
[2] 42588aeba7
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
According to [1], A vulnerability was found in HDF5 1.14.6 and classified
as critical. This issue affects the function H5MM_strndup of the component
Metadata Attribute Decoder. The manipulation leads to heap-based buffer
overflow. Attacking locally is a requirement. The exploit has been
disclosed to the public and may be used.
Backport patch [2] from upstream to fix CVE-2025-2310
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-2310
[2] 6c86f97e03
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
According to [1], A vulnerability, which was classified as critical, was
found in HDF5 1.14.6. Affected is the function H5SM_delete of the file
H5SM.c of the component h5 File Handler. The manipulation leads to
heap-based buffer overflow. It is possible to launch the attack remotely.
The complexity of an attack is rather high. The exploitability is told to
be difficult. The exploit has been disclosed to the public and may be used.
Backport patch [2] from upstream to fix CVE-2025-2153
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-2153
[2] 38954615fc
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
- The CVE tags in multiple hdf5 patches were using comma-separated
format which caused false positives in CVE reports.
- Multiple CVEs should be separated by space in CVE-ID.patch file as
per recipe style guide in Yocto documentation so CVE report tool can
scan those CVEs and mark it as patched.
Fixed the following patches:
- CVE-2025-6269-CVE-2025-6270-CVE-2025-6516_01.patch
- CVE-2025-6269-CVE-2025-6270-CVE-2025-6516_02.patch
- CVE-2025-2923-CVE-2025-6816-CVE-2025-6856.patch
Reference:
- https://docs.yoctoproject.org/contributor-guide/recipe-style-guide.html#cve-patches
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Release notes:
https://github.com/HDFGroup/hdf5/blob/hdf5_1.14.4.3/release_docs/RELEASE.txt
License update: link update
from https://raw.githubusercontent.com/hdfgroup/hdf5/develop/COPYING_LBNL_HDF5
to https://raw.githubusercontent.com/hdfgroup/hdf5/hdf5_1_14/COPYING_LBNL_HDF5.
Upstream has only Released tar file extension is .gz so
SRC_URI tar file extension changed from .bz2 to .gz
Fixes
File /usr/lib/libhdf5.settings in package hdf5 contains reference to TMPDIR
File /usr/src/debug/hdf5/1.14.4-3/src/H5build_settings.c in package
hdf5-src contains reference to TMPDIR [buildpaths]
- Running H5make_libsettings is no longer required for cross-compiling
The functionality of H5make_libsettings is now handled via template files,
so H5make_libsettings has been removed.
- Running H5detect is no longer required for cross-compiling
The functionality of H5detect is now exercised at library startup,
so H5detect has been removed
Rework the patch 0001-cmake-remove-build-flags.patch to fix the build path
issue.
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This variable was removed in oe-core 8c9ef5, and didn't do what any of
these recipes seem to be using it for.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
License Update: link update
from http://support.hdfgroup.org/ftp/HDF5/releases/COPYING_LBNL_HDF5 to
https://raw.githubusercontent.com/hdfgroup/hdf5/develop/COPYING_LBNL_HDF5.
Rework the patch 0001-cmake-remove-build-flags.patch to fix the build path
issue.
Add zlib depends to fix the below failure:
/build/tmp/work/core2-64-poky-linux/hdf5/1.14.2/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/13.2.0/ld: bin/libhdf5.so.310.2.0: undefined reference to `inflateEnd'
/build/tmp/work/core2-64-poky-linux/hdf5/1.14.2/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/13.2.0/ld: bin/libhdf5.so.310.2.0: undefined reference to `inflate'
/build/tmp/work/core2-64-poky-linux/hdf5/1.14.2/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/13.2.0/ld: bin/libhdf5.so.310.2.0: undefined reference to `compress2'
/build/tmp/work/core2-64-poky-linux/hdf5/1.14.2/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/13.2.0/ld: bin/libhdf5.so.310.2.0: undefined reference to `inflateInit_'
collect2: error: ld returned 1 exit status
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Error: Transaction test error:
file /usr/include/H5pubconf.h conflicts between attempted installs of hdf5-dev-1.14.0-r0.core2_64 and lib32-hdf5-dev-1.14.0-r0.i686
The differences between lib32-hdf5-dev and hdf5-dev are as follows:
@@ -479,10 +479,10 @@
#define H5_SIZEOF_INT8_T 1
/* The size of `int_fast16_t', as computed by sizeof. */
-#define H5_SIZEOF_INT_FAST16_T 4
+#define H5_SIZEOF_INT_FAST16_T 8
/* The size of `int_fast32_t', as computed by sizeof. */
-#define H5_SIZEOF_INT_FAST32_T 4
+#define H5_SIZEOF_INT_FAST32_T 8
/* The size of `int_fast64_t', as computed by sizeof. */
#define H5_SIZEOF_INT_FAST64_T 8
@@ -505,16 +505,16 @@
#if !defined(__APPLE__)
/* The size of `size_t', as computed by sizeof. */
-#define H5_SIZEOF_SIZE_T 4
+#define H5_SIZEOF_SIZE_T 8
/* The size of `ssize_t', as computed by sizeof. */
-#define H5_SIZEOF_SSIZE_T 4
+#define H5_SIZEOF_SSIZE_T 8
/* The size of `long', as computed by sizeof. */
-#define H5_SIZEOF_LONG 4
+#define H5_SIZEOF_LONG 8
/* The size of `long double', as computed by sizeof. */
-#define H5_SIZEOF_LONG_DOUBLE 12
+#define H5_SIZEOF_LONG_DOUBLE 16
#else
@@ -538,7 +538,7 @@
# elif defined(__aarch64__)
#define H5_SIZEOF_LONG_DOUBLE 8
# else
- #define H5_SIZEOF_LONG_DOUBLE 12
+ #define H5_SIZEOF_LONG_DOUBLE 16
# endif
#endif
@@ -557,13 +557,13 @@
#define H5_SIZEOF_OFF_T 8
/* The size of `ptrdiff_t', as computed by sizeof. */
-#define H5_SIZEOF_PTRDIFF_T 4
+#define H5_SIZEOF_PTRDIFF_T 8
/* The size of `short', as computed by sizeof. */
#define H5_SIZEOF_SHORT 2
/* The size of `time_t', as computed by sizeof. */
-#define H5_SIZEOF_TIME_T 4
+#define H5_SIZEOF_TIME_T 8
/* The size of `uint16_t', as computed by sizeof. */
#define H5_SIZEOF_UINT16_T 2
@@ -578,10 +578,10 @@
#define H5_SIZEOF_UINT8_T 1
/* The size of `uint_fast16_t', as computed by sizeof. */
-#define H5_SIZEOF_UINT_FAST16_T 4
+#define H5_SIZEOF_UINT_FAST16_T 8
/* The size of `uint_fast32_t', as computed by sizeof. */
-#define H5_SIZEOF_UINT_FAST32_T 4
+#define H5_SIZEOF_UINT_FAST32_T 8
/* The size of `uint_fast64_t', as computed by sizeof. */
#define H5_SIZEOF_UINT_FAST64_T 8
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
License-Update: Add attribution to Lawrence Livermore
National Laboratory and the United States Department of Energy
Drop the Advertizing Clause from COPYING
Forward port patches
Drop 0001-cross-compiling-support.patch
bring in qemu usermode to do runtime pieces of build
Delete cached source files, as they are no longer needed
Upgrade version info in python3-h5py as well to match the upgraded
version number
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is the result of automated script (0.9.1) conversion:
oe-core/scripts/contrib/convert-overrides.py .
converting the metadata to use ":" as the override character instead of "_".
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
While baselib = 'lib64', there is a installed-vs-shipped QA WARNING
...
WARNING: QA Issue: hdf5: Files/directories were installed but not shipped in any package:
/usr/lib/libhdf5_hl_cpp.so.1.8.19
/usr/lib/libhdf5.so
...
Set variable HDF5_INSTALL_LIB_DIR to replace hardcode `lib'.
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
