diff mbox series

[meta-oe,5/9] hdf5: patch CVE-2026-120756

Message ID 20261105200552.81303-5-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,1/9] hdf5: patch CVE-2026-19026, CVE-2026-19027 and CVE-2026-19028 | expand

Commit Message

Ankur Tyagi Nov. 5, 2026, 8:05 p.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120756

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../hdf5/files/CVE-2026-120756.patch          | 45 +++++++++++++++++++
 meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb    |  1 +
 2 files changed, 46 insertions(+)
 create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch
new file mode 100644
index 0000000000..28bd658598
--- /dev/null
+++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch
@@ -0,0 +1,45 @@ 
+From 43855883c1ea10a072b7e7cf2dbc5a29ab411a8f Mon Sep 17 00:00:00 2001
+From: Nayyar <nayyar@bugqore.com>
+Date: Sat, 12 Sep 2026 16:37:49 +0530
+Subject: [PATCH] check object header message size after decoding its header
+ (#6589)
+
+(cherry picked from commit 10f1af5528168c5a71a58eba0b486e0677f3aaa3)
+
+CVE: CVE-2026-120756
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/10f1af5528168c5a71a58eba0b486e0677f3aaa3]
+
+Dropped changes to the test and CHANGELOG file.
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/H5Ocache.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/src/H5Ocache.c b/src/H5Ocache.c
+index 8f0928f290e..9dc6a2e21bb 100644
+--- a/src/H5Ocache.c
++++ b/src/H5Ocache.c
+@@ -1270,9 +1270,6 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t
+         if (mesg_size != H5O_ALIGN_OH(oh, mesg_size))
+             HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL, "message not aligned");
+ 
+-        if (H5_IS_BUFFER_OVERFLOW(chunk_image, mesg_size, p_end))
+-            HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, FAIL, "message size exceeds buffer end");
+-
+         /* Message flags */
+         if (H5_IS_BUFFER_OVERFLOW(chunk_image, 1, p_end))
+             HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, FAIL, "ran off end of input buffer while decoding");
+@@ -1305,6 +1302,13 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t
+             }
+         }
+ 
++        /* The message body starts after the message header, so its size can
++         * only be checked against the buffer once the whole header has been
++         * decoded
++         */
++        if (H5_IS_BUFFER_OVERFLOW(chunk_image, mesg_size, p_end))
++            HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, FAIL, "message size exceeds buffer end");
++
+         /* Increment count of null messages */
+         if (H5O_NULL_ID == id)
+             nullcnt++;
diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
index 7642beb675..7afba18084 100644
--- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
@@ -26,6 +26,7 @@  SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
            file://CVE-2026-19023-CVE-2026-19024.patch \
            file://CVE-2026-120689.patch \
            file://CVE-2026-120754-CVE-2026-120755.patch \
+           file://CVE-2026-120756.patch \
            "
 SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"