aa78456748
* Update to version 1.12.3. * Drop upstreamed patches: Remove-duplicate-code.patch, H5O__pline_decode-Make-more-resilient-to-out-of-bounds-read.patch, H5O_dtype_decode_helper-Parent-of-enum-needs-to-have-same-size-as-enum-itself.patch, Pass-compact-chunk-size-info-to-ensure-requested-elements-are-within-bounds.patch, Make-sure-info-block-for-external-links-has-at-least-3-bytes.patch, Compound-datatypes-may-not-have-members-of-size-0.patch, H5IMget_image_info-H5Sget_simple_extent_dims-does-not-exceed-array-size.patch, Check-for-overflow-when-calculating-on-disk-attribute-data-size-2459.patch * New BuildRequires: hostname. * Work around an sed hack in upstream configure file by dropping "-Werror=return-type" from RPM %optflags. OBS-URL: https://build.opensuse.org/request/show/1173662 OBS-URL: https://build.opensuse.org/package/show/science/hdf5?expand=0&rev=174
39 lines
1.6 KiB
Diff
39 lines
1.6 KiB
Diff
From: Egbert Eich <eich@suse.com>
|
|
Date: Wed Sep 28 19:11:16 2022 +0200
|
|
Subject: Report error if dimensions of chunked storage in data layout < 2
|
|
Patch-mainline: Not yet
|
|
Git-repo: ssh://eich@192.168.122.1:/home/eich/sources/HPC/hdf5
|
|
Git-commit: 34b621424504265cff3c33cf634a70efb52db180
|
|
References:
|
|
|
|
For Data Layout Messages version 1 & 2 the specification state
|
|
that the value stored in the data field is 1 greater than the
|
|
number of dimensions in the dataspace. For version 3 this is
|
|
not explicitly stated but the implementation suggests it to be
|
|
the case.
|
|
Thus the set value needs to be at least 2. For dimensionality
|
|
< 2 an out-of-bounds access occurs as in CVE-2021-45833.
|
|
|
|
This fixes CVE-2021-45833.
|
|
|
|
Signed-off-by: Egbert Eich <eich@suse.com>
|
|
Signed-off-by: Egbert Eich <eich@suse.de>
|
|
---
|
|
src/H5Olayout.c | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
Index: hdf5-1.12.3/src/H5Olayout.c
|
|
===================================================================
|
|
--- hdf5-1.12.3.orig/src/H5Olayout.c
|
|
+++ hdf5-1.12.3/src/H5Olayout.c
|
|
@@ -291,6 +291,10 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_AT
|
|
if (mesg->u.chunk.ndims < 2)
|
|
HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "bad dimensions for chunked storage")
|
|
|
|
+ if (mesg->u.chunk.ndims < 2)
|
|
+ HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL,
|
|
+ "bad dimensions for chunked storage")
|
|
+
|
|
/* B-tree address */
|
|
if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_ADDR(f), p_end))
|
|
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
|