1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
From ac57aaf0186ba175947d370496934fd399fbc225 Mon Sep 17 00:00:00 2001
From: aled-ua <bugbuster.cc@gmail.com>
Date: Wed, 15 Jan 2025 15:02:25 -0600
Subject: [PATCH] Fix vuln OSV-2023-77 (#5210)
CVE: CVE-2025-6269, CVE-2025-6270, CVE-2025-6516
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/7f27ba8c3a8483c3d7e5e2cb21fefb2c7563422d]
(cherry picked from commit 7f27ba8c3a8483c3d7e5e2cb21fefb2c7563422d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/H5Cimage.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/src/H5Cimage.c b/src/H5Cimage.c
index ec1af787d5..72dc52dafb 100644
--- a/src/H5Cimage.c
+++ b/src/H5Cimage.c
@@ -118,7 +118,8 @@ do { \
/* Helper routines */
static size_t H5C__cache_image_block_entry_header_size(const H5F_t *f);
static size_t H5C__cache_image_block_header_size(const H5F_t *f);
-static herr_t H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t **buf);
+static herr_t H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t **buf,
+ size_t buf_size);
#ifndef NDEBUG /* only used in assertions */
static herr_t H5C__decode_cache_image_entry(const H5F_t *f, const H5C_t *cache_ptr, const uint8_t **buf,
unsigned entry_num);
@@ -299,7 +300,7 @@ H5C__construct_cache_image_buffer(H5F_t *f, H5C_t *cache_ptr)
/* needed for sanity checks */
fake_cache_ptr->image_len = cache_ptr->image_len;
q = (const uint8_t *)cache_ptr->image_buffer;
- status = H5C__decode_cache_image_header(f, fake_cache_ptr, &q);
+ status = H5C__decode_cache_image_header(f, fake_cache_ptr, &q, cache_ptr->image_len + 1);
assert(status >= 0);
assert(NULL != p);
@@ -1269,7 +1270,7 @@ H5C__cache_image_block_header_size(const H5F_t *f)
*-------------------------------------------------------------------------
*/
static herr_t
-H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t **buf)
+H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t **buf, size_t buf_size)
{
uint8_t version;
uint8_t flags;
@@ -1289,6 +1290,10 @@ H5C__decode_cache_image_header(const H5F_t *f, H5C_t *cache_ptr, const uint8_t *
/* Point to buffer to decode */
p = *buf;
+ /* Ensure buffer has enough data for signature comparison */
+ if (H5_IS_BUFFER_OVERFLOW(p, H5C__MDCI_BLOCK_SIGNATURE_LEN, *buf + buf_size - 1))
+ HGOTO_ERROR(H5E_CACHE, H5E_OVERFLOW, FAIL, "Insufficient buffer size for signature");
+
/* Check signature */
if (memcmp(p, H5C__MDCI_BLOCK_SIGNATURE, (size_t)H5C__MDCI_BLOCK_SIGNATURE_LEN) != 0)
HGOTO_ERROR(H5E_CACHE, H5E_BADVALUE, FAIL, "Bad metadata cache image header signature");
@@ -2388,7 +2393,7 @@ H5C__reconstruct_cache_contents(H5F_t *f, H5C_t *cache_ptr)
/* Decode metadata cache image header */
p = (uint8_t *)cache_ptr->image_buffer;
- if (H5C__decode_cache_image_header(f, cache_ptr, &p) < 0)
+ if (H5C__decode_cache_image_header(f, cache_ptr, &p, cache_ptr->image_len + 1) < 0)
HGOTO_ERROR(H5E_CACHE, H5E_CANTDECODE, FAIL, "cache image header decode failed");
assert((size_t)(p - (uint8_t *)cache_ptr->image_buffer) < cache_ptr->image_len);
|
