francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
47 lines
1.9 KiB
Diff
47 lines
1.9 KiB
Diff
From d7ed737287ef2ecc6efd006fa11c3f784cdbdba6 Mon Sep 17 00:00:00 2001
|
|
From: Libo Chen <libo.chen.cn@windriver.com>
|
|
Date: Fri, 30 Jan 2026 14:37:09 +0800
|
|
Subject: [PATCH] H5Zscaleoffset: add buffer size check to prevent
|
|
out-of-bounds reads
|
|
|
|
Adds a buffer size check in H5Z__filter_scaleoffset to prevent out-of-bounds reads with malformed HDF5 files.
|
|
|
|
Fixes CVE-2025-44905.
|
|
|
|
CVE: CVE-2025-44905
|
|
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/42588aeba786a121fec1fbad72cf39d8f60a4983]
|
|
|
|
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
|
|
---
|
|
src/H5Zscaleoffset.c | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/src/H5Zscaleoffset.c b/src/H5Zscaleoffset.c
|
|
index 048344b..fbf12d6 100644
|
|
--- a/src/H5Zscaleoffset.c
|
|
+++ b/src/H5Zscaleoffset.c
|
|
@@ -1205,6 +1205,9 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu
|
|
unsigned minval_size = 0;
|
|
|
|
minbits = 0;
|
|
+ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5, (unsigned char *)*buf + *buf_size - 1))
|
|
+ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short");
|
|
+
|
|
for (i = 0; i < 4; i++) {
|
|
minbits_mask = ((unsigned char *)*buf)[i];
|
|
minbits_mask <<= i * 8;
|
|
@@ -1220,6 +1223,9 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu
|
|
minval_size = sizeof(unsigned long long) <= ((unsigned char *)*buf)[4] ? sizeof(unsigned long long)
|
|
: ((unsigned char *)*buf)[4];
|
|
minval = 0;
|
|
+ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size,
|
|
+ (unsigned char *)*buf + *buf_size - 1))
|
|
+ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short");
|
|
for (i = 0; i < minval_size; i++) {
|
|
minval_mask = ((unsigned char *)*buf)[5 + i];
|
|
minval_mask <<= i * 8;
|
|
--
|
|
2.34.1
|
|
|