francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
42 lines
1.9 KiB
Diff
42 lines
1.9 KiB
Diff
From 6b24925c5fae3e2d7f47e9e7c879816673a48cd5 Mon Sep 17 00:00:00 2001
|
|
From: Libo Chen <libo.chen.cn@windriver.com>
|
|
Date: Fri, 30 Jan 2026 15:04:26 +0800
|
|
Subject: [PATCH] Fix CVE-2025-2309
|
|
|
|
A malformed file can trigger bit field type conversions that can (due to missing boundary checks in the conversion step) cause a heap buffer overflow. This PR adds a check on the defined conversion to ensure it does not read beyond the size of a single bit field element. Thus, H5T__bit_copy does not result in a buffer overflow. There are several other calls to H5T__bit_copy which might be subject to a similar issue.
|
|
|
|
This PR fixes CVE-2025-2309.
|
|
|
|
CVE: CVE-2025-2309
|
|
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/9d90b21ef5c5373978014f1a711795aa653bd9a1]
|
|
|
|
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
|
|
---
|
|
src/H5Odtype.c | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/src/H5Odtype.c b/src/H5Odtype.c
|
|
index 24671b0..085ce24 100644
|
|
--- a/src/H5Odtype.c
|
|
+++ b/src/H5Odtype.c
|
|
@@ -307,6 +307,15 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
|
|
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, FAIL, "ran off end of input buffer while decoding");
|
|
UINT16DECODE(*pp, dt->shared->u.atomic.offset);
|
|
UINT16DECODE(*pp, dt->shared->u.atomic.prec);
|
|
+
|
|
+ /* Sanity checks */
|
|
+ if (dt->shared->u.atomic.offset >= (dt->shared->size * 8))
|
|
+ HGOTO_ERROR(H5E_DATATYPE, H5E_BADRANGE, FAIL, "bitfield offset out of bounds");
|
|
+ if (0 == dt->shared->u.atomic.prec)
|
|
+ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, "bitfield precision is zero");
|
|
+ if (((dt->shared->u.atomic.offset + dt->shared->u.atomic.prec) - 1) >= (dt->shared->size * 8))
|
|
+ HGOTO_ERROR(H5E_DATATYPE, H5E_BADRANGE, FAIL, "bitfield offset+precision out of bounds");
|
|
+
|
|
break;
|
|
|
|
case H5T_OPAQUE: {
|
|
--
|
|
2.34.1
|
|
|