mirror/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2025-02-05 15:42:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

H5IMget_image_info(): Make sure to not exceed local array size (#2227)

Browse Source 
Malformed hdf5 files may provide more dimensions than the array dim[] in
H5IMget_image_info() is able to hold. Check number of elements first by calling
H5Sget_simple_extent_dims() with NULL for both 'dims' and 'maxdims' arguments.
This will cause the function to return only the number of dimensions.
The fix addresse a stack overflow on write.

This fixes CVE-2018-17439 / HDFFV-10589 / Bug #2226.

Signed-off-by: Egbert Eich <eich@suse.com>

Signed-off-by: Egbert Eich <eich@suse.com>
This commit is contained in:
Egbert Eich 2022-11-11 06:01:45 +01:00 committed by GitHub
parent 5985d0e0b1
commit 99487d9e45
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hl/src/H5IM.c
View File

@ -281,6 +281,8 @@ H5IMget_image_info(hid_t loc_id, const char *dset_name, hsize_t *width, hsize_t
if ((sid = H5Dget_space(did)) < 0)
goto out;
if (H5Sget_simple_extent_dims(sid, NULL, NULL) > IMAGE24_RANK)
goto out;
/* Get dimensions */
if (H5Sget_simple_extent_dims(sid, dims, NULL) < 0)
goto out;

14
release_docs/RELEASE.txt
View File

@ -172,8 +172,18 @@ Bug Fixes since HDF5-1.13.3 release
===================================
Library
-------
-
- Fix CVE-2018-17439 / GHSA-vcxv-vp43-rch7
H5IMget_image_info(): Make sure to not exceed local array size
Malformed hdf5 files may provide more dimensions than the array dim[] in
H5IMget_image_info() is able to hold. Check number of elements first by calling
H5Sget_simple_extent_dims() with NULL for both 'dims' and 'maxdims' arguments.
This will cause the function to return only the number of dimensions.
The fix addresses a stack overflow on write.
(EFE - 2022/09/27 HDFFV-10589, GH-2226)
Java Library
------------