francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
34 lines
1.4 KiB
Diff
34 lines
1.4 KiB
Diff
From 538a14fc5a1ed393495029d5054d934bc09844ee Mon Sep 17 00:00:00 2001
|
|
From: bmribler <39579120+bmribler@users.noreply.github.com>
|
|
Date: Tue, 5 Aug 2025 09:12:33 -0400
|
|
Subject: [PATCH] Fix reading bad size in the raw header continuation message
|
|
(#5710)
|
|
|
|
This issue was reported in GH-5376 as a heap-use-after-free vulnerability in
|
|
one of the free lists. It appeared that the library came to this vulnerability
|
|
after it encountered an undetected reading of a bad value. The fuzzer now failed
|
|
with an appropriate error message.
|
|
|
|
CVE: CVE-2025-2913 CVE-2025-2912
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/7cc8b5e1010a09c892bc97ac32d9515c3777ce07]
|
|
(cherry picked from commit 7cc8b5e1010a09c892bc97ac32d9515c3777ce07)
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
|
|
---
|
|
src/H5Ocont.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/src/H5Ocont.c b/src/H5Ocont.c
|
|
index 621095a198..c03f4dd1e9 100644
|
|
--- a/src/H5Ocont.c
|
|
+++ b/src/H5Ocont.c
|
|
@@ -100,6 +100,8 @@ H5O__cont_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
|
|
if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end))
|
|
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
|
|
H5F_DECODE_LENGTH(f, p, cont->size);
|
|
+ if (cont->size == 0)
|
|
+ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "invalid continuation chunk size (0)");
|
|
|
|
cont->chunkno = 0;
|
|
|