From 20a34d68dd837f83d90df45ead054bbeda999830 Mon Sep 17 00:00:00 2001 From: bmribler <39579120+bmribler@users.noreply.github.com> Date: Wed, 13 Aug 2025 14:45:41 -0400 Subject: [PATCH] Refix of the attempts in PR-5209 (#5722) This PR addresses the root cause of the issue by adding a sanity-check immediately after reading the file space page size from the file. The same fuzzer in GH-5376 was used to verify that the assert before the vulnerability had occurred and that an error indicating a corrupted file space page size replaced it. CVE: CVE-2025-2914 Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/804f3bace997e416917b235dbd3beac3652a8a05] (cherry picked from commit 804f3bace997e416917b235dbd3beac3652a8a05) Signed-off-by: Ankur Tyagi --- src/H5Fsuper.c | 2 ++ src/H5Ofsinfo.c | 3 +++ 2 files changed, 5 insertions(+) diff --git a/src/H5Fsuper.c b/src/H5Fsuper.c index 3e5bc9a3a2..4de4c1feb0 100644 --- a/src/H5Fsuper.c +++ b/src/H5Fsuper.c @@ -756,6 +756,8 @@ H5F__super_read(H5F_t *f, H5P_genplist_t *fa_plist, bool initial_read) if (!(flags & H5O_MSG_FLAG_WAS_UNKNOWN)) { H5O_fsinfo_t fsinfo; /* File space info message from superblock extension */ + memset(&fsinfo, 0, sizeof(H5O_fsinfo_t)); + /* f->shared->null_fsm_addr: Whether to drop free-space to the floor */ /* The h5clear tool uses this property to tell the library * to drop free-space to the floor diff --git a/src/H5Ofsinfo.c b/src/H5Ofsinfo.c index 5b692357fc..2bb6ea6119 100644 --- a/src/H5Ofsinfo.c +++ b/src/H5Ofsinfo.c @@ -182,6 +182,9 @@ H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end)) HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding"); H5F_DECODE_LENGTH(f, p, fsinfo->page_size); /* File space page size */ + /* Basic sanity check */ + if (fsinfo->page_size == 0 || fsinfo->page_size > H5F_FILE_SPACE_PAGE_SIZE_MAX) + HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "invalid page size in file space info"); if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end)) HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");