diff mbox series

[meta-oe,6/9] hdf5: patch CVE-2026-120757

Message ID 20261105200552.81303-6-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,1/9] hdf5: patch CVE-2026-19026, CVE-2026-19027 and CVE-2026-19028 | expand

Commit Message

Ankur Tyagi Nov. 5, 2026, 8:05 p.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120757

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../hdf5/files/CVE-2026-120757.patch          | 63 +++++++++++++++++++
 meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb    |  1 +
 2 files changed, 64 insertions(+)
 create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch
new file mode 100644
index 0000000000..886d6d946b
--- /dev/null
+++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch
@@ -0,0 +1,63 @@ 
+From fa4c737d41c1c86638525a290b5576c8966090d0 Mon Sep 17 00:00:00 2001
+From: Nayyar <nayyar@bugqore.com>
+Date: Thu, 8 Oct 2026 18:57:14 +0530
+Subject: [PATCH] reject malformed external link data in H5L__extern_traverse
+ (#6708)
+
+* validate external link data before parsing in traversal
+
+(cherry picked from commit 8117f4c75fdfb5e759ad73ce62d7ef4584130acd)
+
+CVE: CVE-2026-120757
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/8117f4c75fdfb5e759ad73ce62d7ef4584130acd]
+
+Dropped changes to the test and CHANGELOG file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/H5Lexternal.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/src/H5Lexternal.c b/src/H5Lexternal.c
+index 793825d1c3d..5f874d53177 100644
+--- a/src/H5Lexternal.c
++++ b/src/H5Lexternal.c
+@@ -93,7 +93,7 @@ static const H5L_class_t H5L_EXTERN_LINK_CLASS[1] = {{
+  */
+ static hid_t
+ H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, const void *_udata,
+-                     size_t H5_ATTR_UNUSED udata_size, hid_t lapl_id, hid_t H5_ATTR_UNUSED dxpl_id)
++                     size_t udata_size, hid_t lapl_id, hid_t H5_ATTR_UNUSED dxpl_id)
+ {
+     H5P_genplist_t    *plist;                              /* Property list pointer */
+     H5G_loc_t          root_loc;                           /* Location of root group in external file */
+@@ -121,6 +121,18 @@ H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, cons
+     /* Sanity checks */
+     assert(p);
+ 
++    /* The udata holds a version/flags byte followed by two NULL-terminated
++     * strings (file name and object path).  The strings are located below with
++     * strlen(), so validate the buffer against udata_size first: it must have
++     * room for both strings and end on a NULL terminator.  A malformed link
++     * from a corrupted file would otherwise read past the udata buffer.  This
++     * matches the checks in H5Lunpack_elink_val().
++     */
++    if (udata_size <= 2)
++        HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data too small");
++    if (p[udata_size - 1] != '\0')
++        HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data is not NULL-terminated");
++
+     /* Check external link version & flags */
+     if (((*p >> 4) & 0x0F) > H5L_EXT_VERSION)
+         HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "bad version number for external link");
+@@ -131,7 +143,9 @@ H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, cons
+     /* Gather some information from the external link's user data */
+     file_name = (const char *)p;
+     fname_len = strlen(file_name);
+-    obj_name  = (const char *)p + fname_len + 1;
++    if ((fname_len + 1) >= (udata_size - 1))
++        HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data has no object path");
++    obj_name = (const char *)p + fname_len + 1;
+ 
+     /* Get the plist structure */
+     if (NULL == (plist = H5P_object_verify(lapl_id, H5P_LINK_ACCESS, true)))
diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
index 7afba18084..3e978a75ac 100644
--- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
@@ -27,6 +27,7 @@  SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
            file://CVE-2026-120689.patch \
            file://CVE-2026-120754-CVE-2026-120755.patch \
            file://CVE-2026-120756.patch \
+           file://CVE-2026-120757.patch \
            "
 SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"