francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From 89a4466d72f688f4da6521e82a466c183ebe1d08 Mon Sep 17 00:00:00 2001
|
|
From: Libo Chen <libo.chen.cn@windriver.com>
|
|
Date: Fri, 30 Jan 2026 14:05:54 +0800
|
|
Subject: [PATCH] Fix CVE-2025-2310
|
|
|
|
Malformed files can have a zero name-length, which when subtracted lead to an overflow and an out-of-bounds read.
|
|
|
|
Check that name length is not too small in addition to checking for an overflow directly.
|
|
|
|
CVE: CVE-2025-2310
|
|
|
|
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/6c86f97e03c6dc7d7bd2bae9acc422bdc3438ff4]
|
|
|
|
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
|
|
---
|
|
src/H5Oattr.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/src/H5Oattr.c b/src/H5Oattr.c
|
|
index 6d1d237..7b7ebb0 100644
|
|
--- a/src/H5Oattr.c
|
|
+++ b/src/H5Oattr.c
|
|
@@ -167,6 +167,11 @@ H5O__attr_decode(H5F_t *f, H5O_t *open_oh, unsigned H5_ATTR_UNUSED mesg_flags, u
|
|
if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
|
|
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
|
|
UINT16DECODE(p, name_len); /* Including null */
|
|
+
|
|
+ /* Verify that retrieved name length (including null byte) is valid */
|
|
+ if (name_len <= 1)
|
|
+ HGOTO_ERROR(H5E_OHDR, H5E_CANTDECODE, NULL, "decoded name length is invalid");
|
|
+
|
|
if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
|
|
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
|
|
UINT16DECODE(p, attr->shared->dt_size);
|
|
--
|
|
2.34.1
|
|
|