From d7ed737287ef2ecc6efd006fa11c3f784cdbdba6 Mon Sep 17 00:00:00 2001 From: Libo Chen Date: Fri, 30 Jan 2026 14:37:09 +0800 Subject: [PATCH] H5Zscaleoffset: add buffer size check to prevent out-of-bounds reads Adds a buffer size check in H5Z__filter_scaleoffset to prevent out-of-bounds reads with malformed HDF5 files. Fixes CVE-2025-44905. CVE: CVE-2025-44905 Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/42588aeba786a121fec1fbad72cf39d8f60a4983] Signed-off-by: Libo Chen --- src/H5Zscaleoffset.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/H5Zscaleoffset.c b/src/H5Zscaleoffset.c index 048344b..fbf12d6 100644 --- a/src/H5Zscaleoffset.c +++ b/src/H5Zscaleoffset.c @@ -1205,6 +1205,9 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu unsigned minval_size = 0; minbits = 0; + if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5, (unsigned char *)*buf + *buf_size - 1)) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + for (i = 0; i < 4; i++) { minbits_mask = ((unsigned char *)*buf)[i]; minbits_mask <<= i * 8; @@ -1220,6 +1223,9 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu minval_size = sizeof(unsigned long long) <= ((unsigned char *)*buf)[4] ? sizeof(unsigned long long) : ((unsigned char *)*buf)[4]; minval = 0; + if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size, + (unsigned char *)*buf + *buf_size - 1)) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); for (i = 0; i < minval_size; i++) { minval_mask = ((unsigned char *)*buf)[5 + i]; minval_mask <<= i * 8; -- 2.34.1