mirror/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2025-03-01 16:28:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #945 in HDFFV/hdf5 from ~DEROBINS/hdf5_der:hdffv_10358 to develop

Browse Source 
* commit 'b877534a330a201e3b5c51d97daa8e01a5c1cd3a':
  Added a fix for HDFFV-10358.
This commit is contained in:
Dana Robinson 2018-03-13 10:13:30 -05:00
commit f0238d0346
4 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
release_docs/RELEASE.txt
View File

@ -377,6 +377,23 @@ Bug Fixes since HDF5-1.10.1 release
(DER - 2018/02/26, HDFFV-10357)
- If an HDF5 file contains a malformed symbol table node that declares
it contains more symbols than it actually contains, the library
can run off the end of the metadata cache buffer while processing
the symbol table node.
This issue was reported to The HDF Group as issue #CVE-2017-17509.
NOTE: The HDF5 C library cannot produce such a file. This condition
should only occur in a corrupt (or deliberately altered) file
or a file created by third-party software.
Performing bounds checks on the buffer while processing fixes the
problem. Instead of the segmentation fault, the normal HDF5 error
handling is invoked.
(DER - 2018/03/12, HDFFV-10358)
Configuration
-------------
- CMake

3
src/H5Gcache.c
View File

@ -170,6 +170,7 @@ H5G__cache_node_deserialize(const void *_image, size_t len, void *_udata,
H5F_t *f = (H5F_t *)_udata; /* User data for callback */
H5G_node_t *sym = NULL; /* Symbol table node created */
const uint8_t *image = (const uint8_t *)_image; /* Pointer to image to deserialize */
const uint8_t *image_end = image + len - 1; /* Pointer to end of image buffer */
void *ret_value = NULL; /* Return value */
FUNC_ENTER_STATIC
@ -203,7 +204,7 @@ H5G__cache_node_deserialize(const void *_image, size_t len, void *_udata,
UINT16DECODE(image, sym->nsyms);
/* entries */
if(H5G__ent_decode_vec(f, &image, sym->entry, sym->nsyms) < 0)
if(H5G__ent_decode_vec(f, &image, image_end, sym->entry, sym->nsyms) < 0)
HGOTO_ERROR(H5E_SYM, H5E_CANTLOAD, NULL, "unable to decode symbol table entries")
/* Set return value */

7
src/H5Gent.c
View File

@ -91,7 +91,7 @@ H5FL_BLK_EXTERN(str_buf);
*-------------------------------------------------------------------------
*/
herr_t
H5G__ent_decode_vec(const H5F_t *f, const uint8_t **pp, H5G_entry_t *ent, unsigned n)
H5G__ent_decode_vec(const H5F_t *f, const uint8_t **pp, const uint8_t *p_end, H5G_entry_t *ent, unsigned n)
{
unsigned u; /* Local index variable */
herr_t ret_value = SUCCEED; /* Return value */
@ -104,9 +104,12 @@ H5G__ent_decode_vec(const H5F_t *f, const uint8_t **pp, H5G_entry_t *ent, unsign
HDassert(ent);
/* decode entries */
for(u = 0; u < n; u++)
for(u = 0; u < n; u++) {
if(*pp > p_end)
HGOTO_ERROR(H5E_SYM, H5E_CANTDECODE, FAIL, "ran off the end of the image buffer")
if(H5G_ent_decode(f, pp, ent + u) < 0)
HGOTO_ERROR(H5E_SYM, H5E_CANTDECODE, FAIL, "can't decode")
}
done:
FUNC_LEAVE_NOAPI(ret_value)

2
src/H5Gpkg.h
View File

@ -395,7 +395,7 @@ H5_DLL void H5G__ent_copy(H5G_entry_t *dst, const H5G_entry_t *src,
H5_copy_depth_t depth);
H5_DLL void H5G__ent_reset(H5G_entry_t *ent);
H5_DLL herr_t H5G__ent_decode_vec(const H5F_t *f, const uint8_t **pp,
H5G_entry_t *ent, unsigned n);
const uint8_t *p_end, H5G_entry_t *ent, unsigned n);
H5_DLL herr_t H5G__ent_encode_vec(const H5F_t *f, uint8_t **pp,
const H5G_entry_t *ent, unsigned n);
H5_DLL herr_t H5G__ent_convert(H5F_t *f, hid_t dxpl_id, H5HL_t *heap,