mirror/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2025-04-06 17:20:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix CVE-2018-13867 (#3336)

Browse Source
This commit is contained in:
Dana Robinson 2023-08-02 15:44:19 -07:00 committed by GitHub
parent 11e28fe8b8
commit 86ddedf522
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
release_docs/RELEASE.txt
View File

@ -265,6 +265,15 @@ Bug Fixes since HDF5-1.14.0 release
===================================
Library
-------
- Fixed CVE-2018-13867
A corrupt file containing an invalid local heap datablock address
could trigger an assert failure when the metadata cache attempted
to load the datablock from storage.
The local heap now verifies that the datablock address is valid
when the local heap header information is parsed.
- Fixed CVE-2018-11202
A malformed file could result in chunk index memory leaks. Under most

6
src/H5HLcache.c
View File

@ -194,6 +194,12 @@ H5HL__hdr_deserialize(H5HL_t *heap, const uint8_t *image, size_t len, H5HL_cache
HGOTO_ERROR(H5E_HEAP, H5E_OVERFLOW, FAIL, "ran off end of input buffer while decoding");
H5F_addr_decode_len(udata->sizeof_addr, &image, &(heap->dblk_addr));
/* Check that the datablock address is valid (might not be true
* in a corrupt file)
*/
if (!H5_addr_defined(heap->dblk_addr))
HGOTO_ERROR(H5E_HEAP, H5E_BADVALUE, FAIL, "bad datablock address");
done:
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5HL__hdr_deserialize() */