From 538a14fc5a1ed393495029d5054d934bc09844ee Mon Sep 17 00:00:00 2001 From: bmribler <39579120+bmribler@users.noreply.github.com> Date: Tue, 5 Aug 2025 09:12:33 -0400 Subject: [PATCH] Fix reading bad size in the raw header continuation message (#5710) This issue was reported in GH-5376 as a heap-use-after-free vulnerability in one of the free lists. It appeared that the library came to this vulnerability after it encountered an undetected reading of a bad value. The fuzzer now failed with an appropriate error message. CVE: CVE-2025-2913 CVE-2025-2912 Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/7cc8b5e1010a09c892bc97ac32d9515c3777ce07] (cherry picked from commit 7cc8b5e1010a09c892bc97ac32d9515c3777ce07) Signed-off-by: Ankur Tyagi Signed-off-by: Sudhir Dumbhare --- src/H5Ocont.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/H5Ocont.c b/src/H5Ocont.c index 621095a198..c03f4dd1e9 100644 --- a/src/H5Ocont.c +++ b/src/H5Ocont.c @@ -100,6 +100,8 @@ H5O__cont_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end)) HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding"); H5F_DECODE_LENGTH(f, p, cont->size); + if (cont->size == 0) + HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "invalid continuation chunk size (0)"); cont->chunkno = 0;