From 6680a7795b76d451ff17f193e5cdca7a86b01699 Mon Sep 17 00:00:00 2001 From: bmribler <39579120+bmribler@users.noreply.github.com> Date: Mon, 3 Nov 2025 13:01:04 -0500 Subject: [PATCH] Fix CVE-2025-2926 (#5841) An image size was corrupted and decoded as 0 resulting in a NULL image buffer, which caused a NULL pointer dereference when the image being copied to the buffer. The invalid image size was caught in the PR #5710. This change catches right before the copying. Fixes GH issue #5384 CVE: CVE-2025-2926 Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/d37b537ff256f0fa65cb4f82b20f286ad9a2e1e2] (cherry picked from commit d37b537ff256f0fa65cb4f82b20f286ad9a2e1e2) Signed-off-by: Ankur Tyagi --- src/H5Ocache.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/H5Ocache.c b/src/H5Ocache.c index 6916a9044c..9b82509812 100644 --- a/src/H5Ocache.c +++ b/src/H5Ocache.c @@ -610,6 +610,7 @@ H5O__cache_chk_get_initial_load_size(void *_udata, size_t *image_len) assert(udata); assert(udata->oh); assert(image_len); + assert(udata->size); /* Set the image length size */ *image_len = udata->size;