summaryrefslogtreecommitdiffstats
path: root/meta-oe
diff options
context:
space:
mode:
Diffstat (limited to 'meta-oe')
-rw-r--r--meta-oe/recipes-support/hdf5/files/CVE-2025-6857.patch255
-rw-r--r--meta-oe/recipes-support/hdf5/hdf5_1.14.4-3.bb1
2 files changed, 256 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2025-6857.patch b/meta-oe/recipes-support/hdf5/files/CVE-2025-6857.patch
new file mode 100644
index 0000000000..cc1301fb94
--- /dev/null
+++ b/meta-oe/recipes-support/hdf5/files/CVE-2025-6857.patch
@@ -0,0 +1,255 @@
1From eb3af284cc0ac8c758c65f492fc693ed50539592 Mon Sep 17 00:00:00 2001
2From: Libo Chen <libo.chen.cn@windriver.com>
3Date: Thu, 29 Jan 2026 13:59:39 +0800
4Subject: [PATCH] Fix CVE-2025-6857
5
6Add additional checks for v1 B-tree corruption
7
8An HDF5 file had a corrupted v1 B-tree that would result in a stack overflow when performing a lookup on it. This has been fixed with additional integrity checks.
9
10CVE: CVE-2025-6857
11
12Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/a8ceb1d95bb997f548c1129363dad53c18540096]
13
14In addition to the upstream backport, this patch includes two adaptation
15changes for HDF5 1.14.4. First, the H5B_UNKNOWN_NODELEVEL macro and the
16exp_level field are introduced in H5Bpkg.h, as these do not exist in 1.14.4
17due to differences with the 2.0.0 codebase. Second, the
18"cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL" statements are added in H5B_*
19functions to initialize the new field.
20
21Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
22---
23 src/H5B.c | 92 +++++++++++++++++++++++++++++++++++++++++++---------
24 src/H5Bpkg.h | 6 ++++
25 2 files changed, 83 insertions(+), 15 deletions(-)
26
27diff --git a/src/H5B.c b/src/H5B.c
28index 5a7a238..4efa679 100644
29--- a/src/H5B.c
30+++ b/src/H5B.c
31@@ -140,6 +140,8 @@ typedef struct H5B_ins_ud_t {
32 /********************/
33 /* Local Prototypes */
34 /********************/
35+static herr_t H5B_find_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, int exp_level, bool *found,
36+ void *udata);
37 static H5B_ins_t H5B__insert_helper(H5F_t *f, H5B_ins_ud_t *bt_ud, const H5B_class_t *type, uint8_t *lt_key,
38 bool *lt_key_changed, uint8_t *md_key, void *udata, uint8_t *rt_key,
39 bool *rt_key_changed, H5B_ins_ud_t *split_bt_ud /*out*/);
40@@ -252,26 +254,67 @@ done:
41 } /* end H5B_create() */
42
43 /*-------------------------------------------------------------------------
44- * Function: H5B_find
45+ * Function: H5B_find
46 *
47- * Purpose: Locate the specified information in a B-tree and return
48- * that information by filling in fields of the caller-supplied
49- * UDATA pointer depending on the type of leaf node
50- * requested. The UDATA can point to additional data passed
51- * to the key comparison function.
52+ * Purpose: Locate the specified information in a B-tree and return
53+ * that information by filling in fields of the
54+ * caller-supplied UDATA pointer depending on the type of leaf
55+ * node requested. The UDATA can point to additional data
56+ * passed to the key comparison function.
57 *
58- * Note: This function does not follow the left/right sibling
59- * pointers since it assumes that all nodes can be reached
60- * from the parent node.
61+ * Note: This function does not follow the left/right sibling
62+ * pointers since it assumes that all nodes can be reached
63+ * from the parent node.
64 *
65- * Return: Non-negative (true/false) on success (if found, values returned
66- * through the UDATA argument). Negative on failure (if not found,
67- * UDATA is undefined).
68+ * Return: Non-negative (true/false) on success (if found, values
69+ * returned through the UDATA argument). Negative on failure
70+ * (if not found, UDATA is undefined).
71 *
72 *-------------------------------------------------------------------------
73 */
74 herr_t
75 H5B_find(H5F_t *f, const H5B_class_t *type, haddr_t addr, bool *found, void *udata)
76+{
77+ herr_t ret_value = SUCCEED;
78+
79+ FUNC_ENTER_NOAPI(FAIL)
80+
81+ /*
82+ * Check arguments.
83+ */
84+ assert(f);
85+ assert(type);
86+ assert(type->decode);
87+ assert(type->cmp3);
88+ assert(type->found);
89+ assert(H5_addr_defined(addr));
90+
91+ if ((ret_value = H5B_find_helper(f, type, addr, H5B_UNKNOWN_NODELEVEL, found, udata)) < 0)
92+ HGOTO_ERROR(H5E_BTREE, H5E_NOTFOUND, FAIL, "can't lookup key");
93+
94+done:
95+ FUNC_LEAVE_NOAPI(ret_value)
96+} /* end H5B_find() */
97+
98+/*-------------------------------------------------------------------------
99+ * Function: H5B_find_helper
100+ *
101+ * Purpose: Recursive helper routine for H5B_find used to track node
102+ * levels and attempt to detect B-tree corruption during
103+ * lookups.
104+ *
105+ * Note: This function does not follow the left/right sibling
106+ * pointers since it assumes that all nodes can be reached
107+ * from the parent node.
108+ *
109+ * Return: Non-negative on success (if found, values returned through
110+ * the UDATA argument). Negative on failure (if not found,
111+ * UDATA is undefined).
112+ *
113+ *-------------------------------------------------------------------------
114+ */
115+static herr_t
116+H5B_find_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, int exp_level, bool *found, void *udata)
117 {
118 H5B_t *bt = NULL;
119 H5UC_t *rc_shared; /* Ref-counted shared info */
120@@ -281,7 +324,7 @@ H5B_find(H5F_t *f, const H5B_class_t *type, haddr_t addr, bool *found, void *uda
121 int cmp = 1; /* Key comparison value */
122 herr_t ret_value = SUCCEED; /* Return value */
123
124- FUNC_ENTER_NOAPI(FAIL)
125+ FUNC_ENTER_NOAPI_NOINIT
126
127 /*
128 * Check arguments.
129@@ -306,6 +349,7 @@ H5B_find(H5F_t *f, const H5B_class_t *type, haddr_t addr, bool *found, void *uda
130 cache_udata.f = f;
131 cache_udata.type = type;
132 cache_udata.rc_shared = rc_shared;
133+ cache_udata.exp_level = exp_level;
134 if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG)))
135 HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, FAIL, "unable to load B-tree node");
136
137@@ -329,7 +373,17 @@ H5B_find(H5F_t *f, const H5B_class_t *type, haddr_t addr, bool *found, void *uda
138 assert(idx < bt->nchildren);
139
140 if (bt->level > 0) {
141- if ((ret_value = H5B_find(f, type, bt->child[idx], found, udata)) < 0)
142+ /* Sanity check to catch the case where the current node points to
143+ * itself and the current node was loaded with an expected node level
144+ * of H5B_UNKNOWN_NODELEVEL, thus bypassing the expected node level
145+ * check during deserialization and in the future if the node was
146+ * cached.
147+ */
148+ if (bt->child[idx] == addr)
149+ HGOTO_ERROR(H5E_BTREE, H5E_BADVALUE, FAIL, "cyclic B-tree detected");
150+
151+ if ((ret_value = H5B_find_helper(f, type, bt->child[idx], (int)(bt->level - 1), found, udata)) <
152+ 0)
153 HGOTO_ERROR(H5E_BTREE, H5E_NOTFOUND, FAIL, "can't lookup key in subtree");
154 } /* end if */
155 else {
156@@ -343,7 +397,7 @@ done:
157 HDONE_ERROR(H5E_BTREE, H5E_CANTUNPROTECT, FAIL, "unable to release node");
158
159 FUNC_LEAVE_NOAPI(ret_value)
160-} /* end H5B_find() */
161+} /* end H5B_find_helper() */
162
163 /*-------------------------------------------------------------------------
164 * Function: H5B__split
165@@ -425,6 +479,7 @@ H5B__split(H5F_t *f, H5B_ins_ud_t *bt_ud, unsigned idx, void *udata, H5B_ins_ud_
166 cache_udata.f = f;
167 cache_udata.type = shared->type;
168 cache_udata.rc_shared = bt_ud->bt->rc_shared;
169+ cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL;
170 if (NULL == (split_bt_ud->bt =
171 (H5B_t *)H5AC_protect(f, H5AC_BT, split_bt_ud->addr, &cache_udata, H5AC__NO_FLAGS_SET)))
172 HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, FAIL, "unable to protect B-tree");
173@@ -532,6 +587,7 @@ H5B_insert(H5F_t *f, const H5B_class_t *type, haddr_t addr, void *udata)
174 cache_udata.f = f;
175 cache_udata.type = type;
176 cache_udata.rc_shared = rc_shared;
177+ cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL;
178 bt_ud.addr = addr;
179 if (NULL == (bt_ud.bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__NO_FLAGS_SET)))
180 HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, FAIL, "unable to locate root of B-tree");
181@@ -789,6 +845,7 @@ H5B__insert_helper(H5F_t *f, H5B_ins_ud_t *bt_ud, const H5B_class_t *type, uint8
182 cache_udata.f = f;
183 cache_udata.type = type;
184 cache_udata.rc_shared = rc_shared;
185+ cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL;
186
187 if (0 == bt->nchildren) {
188 /*
189@@ -1077,6 +1134,7 @@ H5B__iterate_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, H5B_operato
190 cache_udata.f = f;
191 cache_udata.type = type;
192 cache_udata.rc_shared = rc_shared;
193+ cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL;
194 if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG)))
195 HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, H5_ITER_ERROR, "unable to load B-tree node");
196
197@@ -1190,6 +1248,7 @@ H5B__remove_helper(H5F_t *f, haddr_t addr, const H5B_class_t *type, int level, u
198 cache_udata.f = f;
199 cache_udata.type = type;
200 cache_udata.rc_shared = rc_shared;
201+ cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL;
202 if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__NO_FLAGS_SET)))
203 HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, H5B_INS_ERROR, "unable to load B-tree node");
204
205@@ -1542,6 +1601,7 @@ H5B_delete(H5F_t *f, const H5B_class_t *type, haddr_t addr, void *udata)
206 cache_udata.f = f;
207 cache_udata.type = type;
208 cache_udata.rc_shared = rc_shared;
209+ cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL;
210 if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__NO_FLAGS_SET)))
211 HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, FAIL, "unable to load B-tree node");
212
213@@ -1782,6 +1842,7 @@ H5B__get_info_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, const H5B_
214 cache_udata.f = f;
215 cache_udata.type = type;
216 cache_udata.rc_shared = rc_shared;
217+ cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL;
218 if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG)))
219 HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, FAIL, "unable to load B-tree node");
220
221@@ -1923,6 +1984,7 @@ H5B_valid(H5F_t *f, const H5B_class_t *type, haddr_t addr)
222 cache_udata.f = f;
223 cache_udata.type = type;
224 cache_udata.rc_shared = rc_shared;
225+ cache_udata.exp_level = H5B_UNKNOWN_NODELEVEL;
226 if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG)))
227 HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, FAIL, "unable to protect B-tree node");
228
229diff --git a/src/H5Bpkg.h b/src/H5Bpkg.h
230index d1ad647..f75e857 100644
231--- a/src/H5Bpkg.h
232+++ b/src/H5Bpkg.h
233@@ -39,6 +39,11 @@
234 /* # of bits for node level: 1 byte */
235 #define LEVEL_BITS 8
236
237+/* Indicates that the level of the current node is unknown. When the level
238+ * is known, it can be used to detect corrupted level during decoding
239+ */
240+#define H5B_UNKNOWN_NODELEVEL -1
241+
242 /****************************/
243 /* Package Private Typedefs */
244 /****************************/
245@@ -60,6 +65,7 @@ typedef struct H5B_t {
246 typedef struct H5B_cache_ud_t {
247 H5F_t *f; /* File that B-tree node is within */
248 const struct H5B_class_t *type; /* Type of tree */
249+ int exp_level; /* Expected level of the current node */
250 H5UC_t *rc_shared; /* Ref-counted shared info */
251 } H5B_cache_ud_t;
252
253--
2542.34.1
255
diff --git a/meta-oe/recipes-support/hdf5/hdf5_1.14.4-3.bb b/meta-oe/recipes-support/hdf5/hdf5_1.14.4-3.bb
index b31a8d8cfa..816bd752a1 100644
--- a/meta-oe/recipes-support/hdf5/hdf5_1.14.4-3.bb
+++ b/meta-oe/recipes-support/hdf5/hdf5_1.14.4-3.bb
@@ -29,6 +29,7 @@ SRC_URI = " \
29 file://CVE-2025-44905.patch \ 29 file://CVE-2025-44905.patch \
30 file://CVE-2025-2309.patch \ 30 file://CVE-2025-2309.patch \
31 file://CVE-2025-2308.patch \ 31 file://CVE-2025-2308.patch \
32 file://CVE-2025-6857.patch \
32" 33"
33SRC_URI[sha256sum] = "019ac451d9e1cf89c0482ba2a06f07a46166caf23f60fea5ef3c37724a318e03" 34SRC_URI[sha256sum] = "019ac451d9e1cf89c0482ba2a06f07a46166caf23f60fea5ef3c37724a318e03"
34 35
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-17 13:04:27 +0000