mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-10-02 16:55:11 +00:00
b42e6eb3e5
Details https://nvd.nist.gov/vuln/detail/CVE-2025-2913 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
33 lines
1.4 KiB
Diff
33 lines
1.4 KiB
Diff
From 538a14fc5a1ed393495029d5054d934bc09844ee Mon Sep 17 00:00:00 2001
|
|
From: bmribler <39579120+bmribler@users.noreply.github.com>
|
|
Date: Tue, 5 Aug 2025 09:12:33 -0400
|
|
Subject: [PATCH] Fix reading bad size in the raw header continuation message
|
|
(#5710)
|
|
|
|
This issue was reported in GH-5376 as a heap-use-after-free vulnerability in
|
|
one of the free lists. It appeared that the library came to this vulnerability
|
|
after it encountered an undetected reading of a bad value. The fuzzer now failed
|
|
with an appropriate error message.
|
|
|
|
CVE: CVE-2025-2913
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/7cc8b5e1010a09c892bc97ac32d9515c3777ce07]
|
|
(cherry picked from commit 7cc8b5e1010a09c892bc97ac32d9515c3777ce07)
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
src/H5Ocont.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/src/H5Ocont.c b/src/H5Ocont.c
|
|
index 621095a198..c03f4dd1e9 100644
|
|
--- a/src/H5Ocont.c
|
|
+++ b/src/H5Ocont.c
|
|
@@ -100,6 +100,8 @@ H5O__cont_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
|
|
if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end))
|
|
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
|
|
H5F_DECODE_LENGTH(f, p, cont->size);
|
|
+ if (cont->size == 0)
|
|
+ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "invalid continuation chunk size (0)");
|
|
|
|
cont->chunkno = 0;
|
|
|