mirror/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2025-01-24 15:25:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make sure info block for external links has at least 3 bytes (#2234)

Browse Source 
According to the specification, the information block for external links
contains 1 byte of version/flag information and two 0 terminated strings
for the object linked to and the full path.
Although not very useful, the minimum string length for each (with
terminating 0) would be one byte.
Checking this will help to avoid SEGVs triggered by bogus files.

This fixes CVE-2018-16438 / Bug #2233.

Signed-off-by: Egbert Eich <eich@suse.com>
This commit is contained in:
Egbert Eich 2022-11-11 06:41:53 +01:00 committed by GitHub
parent 1750b4b0af
commit 34ec3bb7bc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
release_docs/RELEASE.txt
View File

@ -172,6 +172,19 @@ Bug Fixes since HDF5-1.13.3 release
===================================
Library
-------
- Fix CVE-2018-16438 / GHSA-9xmm-cpf8-rgmx
Make sure info block for external links has at least 3 bytes.
According to the specification, the information block for external links
contains 1 byte of version/flag information and two 0 terminated strings
for the object linked to and the full path.
Although not very useful, the minimum string length for each (with
terminating 0) would be one byte.
Checking this helps to avoid SEGVs triggered by bogus files.
(EFE - 2022/10/09 GH-2233)
- Fix CVE-2018-13867 / GHSA-j8jr-chrh-qfrf
Validate location (offset) of the accumulated metadata when comparing.

2
src/H5Olink.c
View File

@ -239,6 +239,8 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
/* A UD link. Get the user-supplied data */
UINT16DECODE(p, len)
if (lnk->type == H5L_TYPE_EXTERNAL && len < 3)
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "external link information length < 3")
lnk->u.ud.size = len;
if (len > 0) {
/* Make sure that length doesn't exceed buffer size, which could