diff mbox series

[meta-oe,2/2] hdf5: Fix CVE-2026-26197

Message ID 20260805050922.3936520-2-devanshp@cisco.com
State Under Review
Headers show
Series [meta-oe,1/2] hdf5: Fix CVE-2026-26199 | expand

Commit Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 5, 2026, 5:09 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream HDF5 2.1.0 backport for
CVE-2026-26197. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6
[2] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../hdf5/files/CVE-2026-26197.patch           | 70 +++++++++++++++++++
 meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb    |  1 +
 2 files changed, 71 insertions(+)
 create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-26197.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-26197.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-26197.patch
new file mode 100644
index 0000000000..c8d3547e08
--- /dev/null
+++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-26197.patch
@@ -0,0 +1,70 @@ 
+From 7a9f34e150beb688397d3f562d0f6ed1f9cd0e60 Mon Sep 17 00:00:00 2001
+From: bmribler <39579120+bmribler@users.noreply.github.com>
+Date: Tue, 3 Feb 2026 16:26:51 -0500
+Subject: [PATCH] Validate datatype size for consistency (#6173)
+
+User report:
+When a file is corrupted such that an array datatype's size, the
+number of elements, and the element size are not in agreement, it can
+trigger an out of bounds read.
+(private GH issue: GHSA-gh44-7wpq-622f)
+Added a validation to ensure the above are in agreement.
+
+CVE: CVE-2026-26197
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6]
+
+Backport Changes:
+- Omitted release_docs/CHANGELOG.md because its HDF5 2.1.0 release
+  context does not apply to the 2.0.0 backport.
+
+(cherry picked from commit 8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ src/H5Odtype.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/src/H5Odtype.c b/src/H5Odtype.c
+index f53f608ee..d6405cdb8 100644
+--- a/src/H5Odtype.c
++++ b/src/H5Odtype.c
+@@ -774,7 +774,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
+                 HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "invalid datatype location");
+             break;
+ 
+-        case H5T_ARRAY:
++        case H5T_ARRAY: {
++            size_t expected_size; /* for validating array datatype size consistency */
+             /*
+              * Array datatypes...
+              */
+@@ -816,6 +817,22 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
+             if (H5O__dtype_decode_helper(ioflags, pp, dt->shared->parent, skip, p_end) < 0)
+                 HGOTO_ERROR(H5E_DATATYPE, H5E_CANTDECODE, FAIL, "unable to decode array parent type");
+ 
++            /* Check for multiplication overflow */
++            if (dt->shared->parent->shared->size > 0 &&
++                dt->shared->u.array.nelem > SIZE_MAX / dt->shared->parent->shared->size)
++                HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL,
++                            "array datatype size calculation would overflow");
++
++            expected_size = dt->shared->parent->shared->size * dt->shared->u.array.nelem;
++
++            /* Verify the stored size matches the calculated size */
++            if (dt->shared->size != expected_size)
++                HGOTO_ERROR(
++                    H5E_DATATYPE, H5E_BADVALUE, FAIL,
++                    "array datatype size mismatch: expected %zu (element_size=%zu * nelem=%zu), got %zu",
++                    expected_size, dt->shared->parent->shared->size, dt->shared->u.array.nelem,
++                    dt->shared->size);
++
+             /* Check if the parent of this array has a version greater than the
+              * array itself. */
+             H5O_DTYPE_CHECK_VERSION(dt, version, dt->shared->parent->shared->version, ioflags, "array", FAIL)
+@@ -829,6 +846,7 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
+             if (dt->shared->parent->shared->force_conv == true)
+                 dt->shared->force_conv = true;
+             break;
++        }
+ 
+         case H5T_COMPLEX: {
+             bool homogeneous;
diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
index b28d1e0faf..20b2f1100e 100644
--- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
@@ -17,6 +17,7 @@  SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
            file://0002-Remove-suffix-shared-from-shared-library-name.patch \
            file://0001-cmake-remove-build-flags.patch \
            file://CVE-2026-26199.patch \
+           file://CVE-2026-26197.patch \
            "
 SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"