francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
67 lines
3.4 KiB
Diff
67 lines
3.4 KiB
Diff
From ac57aaf0186ba175947d370496934fd399fbc225 Mon Sep 17 00:00:00 2001
|
|
From: aled-ua <bugbuster.cc@gmail.com>
|
|
Date: Wed, 15 Jan 2025 15:02:25 -0600
|
|
Subject: [PATCH] Fix vuln OSV-2023-77 (#5210)
|
|
|
|
CVE: CVE-2025-6269 CVE-2025-6270 CVE-2025-6516
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/7f27ba8c3a8483c3d7e5e2cb21fefb2c7563422d]
|
|
(cherry picked from commit 7f27ba8c3a8483c3d7e5e2cb21fefb2c7563422d)
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
|
|
---
|
|
src/H5Cimage.c | 13 +++++++++----
|
|
1 file changed, 9 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/H5Cimage.c b/src/H5Cimage.c
|
|
index ec1af787d5..72dc52dafb 100644
|
|
--- a/src/H5Cimage.c
|
|
+++ b/src/H5Cimage.c
|
|
@@ -118,7 +118,8 @@ do { \
|
|
/* Helper routines */
|
|
static size_t H5C__cache_image_block_entry_header_size(const H5F_t *f);
|
|
static size_t H5C__cache_image_block_header_size(const H5F_t *f);
|
|
-static herr_t H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t **buf);
|
|
+static herr_t H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t **buf,
|
|
+ size_t buf_size);
|
|
#ifndef NDEBUG /* only used in assertions */
|
|
static herr_t H5C__decode_cache_image_entry(const H5F_t *f, const H5C_t *cache_ptr, const uint8_t **buf,
|
|
unsigned entry_num);
|
|
@@ -299,7 +300,7 @@ H5C__construct_cache_image_buffer(H5F_t *f, H5C_t *cache_ptr)
|
|
/* needed for sanity checks */
|
|
fake_cache_ptr->image_len = cache_ptr->image_len;
|
|
q = (const uint8_t *)cache_ptr->image_buffer;
|
|
- status = H5C__decode_cache_image_header(f, fake_cache_ptr, &q);
|
|
+ status = H5C__decode_cache_image_header(f, fake_cache_ptr, &q, cache_ptr->image_len + 1);
|
|
assert(status >= 0);
|
|
|
|
assert(NULL != p);
|
|
@@ -1269,7 +1270,7 @@ H5C__cache_image_block_header_size(const H5F_t *f)
|
|
*-------------------------------------------------------------------------
|
|
*/
|
|
static herr_t
|
|
-H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t **buf)
|
|
+H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t **buf, size_t buf_size)
|
|
{
|
|
uint8_t version;
|
|
uint8_t flags;
|
|
@@ -1289,6 +1290,10 @@ H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t *
|
|
/* Point to buffer to decode */
|
|
p = *buf;
|
|
|
|
+ /* Ensure buffer has enough data for signature comparison */
|
|
+ if (H5_IS_BUFFER_OVERFLOW(p, H5C__MDCI_BLOCK_SIGNATURE_LEN, *buf + buf_size - 1))
|
|
+ HGOTO_ERROR(H5E_CACHE, H5E_OVERFLOW, FAIL, "Insufficient buffer size for signature");
|
|
+
|
|
/* Check signature */
|
|
if (memcmp(p, H5C__MDCI_BLOCK_SIGNATURE, (size_t)H5C__MDCI_BLOCK_SIGNATURE_LEN) != 0)
|
|
HGOTO_ERROR(H5E_CACHE, H5E_BADVALUE, FAIL, "Bad metadata cache image header signature");
|
|
@@ -2388,7 +2393,7 @@ H5C__reconstruct_cache_contents(H5F_t *f, H5C_t *cache_ptr)
|
|
|
|
/* Decode metadata cache image header */
|
|
p = (uint8_t *)cache_ptr->image_buffer;
|
|
- if (H5C__decode_cache_image_header(f, cache_ptr, &p) < 0)
|
|
+ if (H5C__decode_cache_image_header(f, cache_ptr, &p, cache_ptr->image_len + 1) < 0)
|
|
HGOTO_ERROR(H5E_CACHE, H5E_CANTDECODE, FAIL, "cache image header decode failed");
|
|
assert((size_t)(p - (uint8_t *)cache_ptr->image_buffer) < cache_ptr->image_len);
|
|
|