From patchwork Thu Nov 5 20:05:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103166 Received: from mail-dl1-f52.google.com (mail-dl1-f52.google.com [74.125.82.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5188.1793909159992428195 for ; Thu, 05 Nov 2026 12:06:00 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=gLdYk4GL; spf=pass (domain: gmail.com, ip: 74.125.82.52, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f52.google.com with SMTP id a92af1059eb24-1b244fb7fffso3025751c88.1 for ; Thu, 05 Nov 2026 12:05:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909159; x=1794513959; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=R7m7vHQdo081FSkPjgBwSNUeE0SstCgiCgvn0Ztg4zQ=; b=gLdYk4GLJQiHNzfmDGkOdiGOg+ReIOYImePu593vA24aAC2vqF+JASLggdiS1v47UB nF35XpbXQp/hAkKjgXLEOU6PaZVrymHuhPNE0WMnLPFk0rLmHd9EqRpOOeFkQ8wK8a4T dgPdpUMrfoy3y66/iF34+L+fNmi5QbJ8oIjIoj6QxSZTEteB/Gbtqy1KmWF2EMLkdSWl whkgdYHO1/6W4NBipAeNYSTkij34C405Yu++Et4WbAwhV2NUV5jAn2QrGqM/TlAHVfEE ZnH8dssuHOSQSD0WBeiMc4l6STZOMN1LhqgGr3yvAZnrMu/DNTwUF3j+WHBcXxPH0LiK nT+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909159; x=1794513959; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=R7m7vHQdo081FSkPjgBwSNUeE0SstCgiCgvn0Ztg4zQ=; b=VjL5hP+AJdbw5/N5u2NCUu6kMheQcuIC3IuZ8dkvW0l1/m8X8Ushtc2c8lhcT7D0j9 rMJR8AVNRm3A2t36XsuVJ+wDZr+ukbbZLC9osqN+j8UcoOkdUxh7agfOsZTSkRMIIFn9 +5qc4gcD3DUgOLhiKiBzKIMnMxRVK067hpoWydatTqj+VeR2snXJnWMe/kapjorOSuhp K6lndnCBmVpKFwTe+bdDAimvmqn6EWrYwjDKFSbS6Szo+SZ7euzjg90vjQfhljX5rO+C kx5IAVxUY0zgk5ydYBJBramSb1HWgGolzlEmDpdvR+VhVFartGo4wTkLivW3HcAC9WR7 OWQA== X-Gm-Message-State: APuU4Z8mvWP5vakce0ZhGcHo01fGu3IBmAFhaYbOEJTsubKdBWG/j7cR OgH4IRMeJXbbmr3f6Hc4plk/80Ic5W7m1DYsx6CIP8d+724aZDVhm1aatDSS4w== X-Gm-Gg: AYBFou1ldu5EndFdcNpmfEJdKs8FW/drRUQAtpzCakmY0vBiRGR70yICF3JujG1tk0y hV0KU0rjuQZrg3/Anzd/iYNiQGXbE1nck/XDyEyYQllbmeQGOga5qC7rbOtWEiIyf4K4QVXLzRC GyAL0TEcaH2U+HhD/8qIKiSnK1c7lBOgjCukaODMvoyoFjlMSKkAblJOMOrnYXtYwyJRaPIjru+ aIqGhQg0xHZh6Weig67kiQgbDnFZN5gfE3L6V02BOVqoquNXkhiMqwH6olBVurY2d3AhnoB6uCK rsj0SVQKdWI7oQSVQZ05WIl0mgVMV1aMHMZ7N+UUKkWwsMKsaJsCP3N1Cx8/r1TFsCcYRzZAJds SQAAnyJ4jotLrKROyjRkrA4LSMEXvjE0hqc/GO1YLjRYuhHSDwjSrpPr2Ng+FHJxoZu3bgfioFq IduebVi4vX49yvblj7l6tiSDjfus1PNfXAiwkSVSOAtGa2Tr00qvOg2j1M96/dY3fdWMTQTwNCP K2paCWPigIrb150a1UaVm8u+GdWrUZ+8iST1HK5RPBrDGIY97hLXOa5tZysCcaap/gnbjiZ4gUM dX3noDxRN+FPOIa/1rQx2+1fQ/2LsDkO4/aRJDztE5s011QzCqtVRu/LCcy3TOW1mjsboeYRxOy oXlYZz/I= X-Received: by 2002:a05:7022:98b:b0:1b2:43ac:d3a3 with SMTP id a92af1059eb24-1b25d34a815mr86903c88.24.1793909159025; Thu, 05 Nov 2026 12:05:59 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.05.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:05:58 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 1/9] hdf5: patch CVE-2026-19026, CVE-2026-19027 and CVE-2026-19028 Date: Fri, 6 Nov 2026 09:05:44 +1300 Message-ID: <20261105200552.81303-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131929 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-19026 https://nvd.nist.gov/vuln/detail/cve-2026-19027 https://nvd.nist.gov/vuln/detail/cve-2026-19028 Signed-off-by: Ankur Tyagi --- ...-19026-CVE-2026-19027-CVE-2026-19028.patch | 579 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 580 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch new file mode 100644 index 0000000000..8187612342 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch @@ -0,0 +1,579 @@ +From 8623863e172662af94d30842e1f735219b682852 Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Fri, 25 Sep 2026 17:15:06 -0500 +Subject: [PATCH] Fix CVE issues related to Nbit/Fletcher32 decode paths + (#6497) + +* Fix h5ls SIGSEGVs in Nbit and Fletcher32 filter decode paths + +This PR fixes three related issues which could cause crashes when +crafted files were provided to h5ls. As it happens, all three are reachable from +any reader via H5Z_pipeline() during a chunked H5Dread(), so the root issues +affect the library itself. + +1. Nbit NULL/short parameter array (#6489, "Null_Pointer") + + H5Z__filter_nbit() dereferenced cd_values[0] before validating the + parameter array. A file storing the filter with zero client-data + values produced cd_values=NULL / cd_nelmts=0 and a NULL dereference. + + Fix is to reject a NULL cd_values or a cd_nelmts < 5 (the header at indices + 0..4 is always read) before any access. + +2. Nbit compressed-input buffer over-read (#6489, "Heap_Corruption_1") + + The H5Z__nbit_decompress* family walked the compressed input via + index *j with no bound against the input size, and nbytes was never + even passed in. Malformed parameters (e.g. d_nelmts=67108876 over a + 31-byte chunk) drove *j past the end, reading out of bounds in + H5Z__nbit_decompress_one_byte(). + + Fix is thread the input size through the whole decompress call chain, + convert the void helpers (_one_byte, _one_nooptype, _one_atomic) + to return herr_t, and bounds-check *j against buffer_size before every + buffer[*j] read, propagating a filter error up the stack. + +3. Fletcher32 checksum length underflow (#6490, "Heap_Corruption_2") + + The read path computed `src_nbytes = nbytes - FLETCHER_LEN` with no + lower-bound check. A corrupt 0-byte chunk underflowed src_nbytes to + SIZE_MAX-3, which was passed straight to H5_checksum_fletcher32(), + causing an out-of-bounds read. + + Fix is to reject nbytes +Co-authored-by: H. Joe Lee + +CVE: CVE-2026-19026 CVE-2026-19027 CVE-2026-19028 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/a3cf1ea82cc7a66e50029a688121e1b105a7ce88] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Zfletcher32.c | 8 ++ + src/H5Znbit.c | 211 +++++++++++++++++++++++++++++++++----------- + 2 files changed, 166 insertions(+), 53 deletions(-) + +diff --git a/src/H5Zfletcher32.c b/src/H5Zfletcher32.c +index c3ec5f7ccb0..b89724ad0a3 100644 +--- a/src/H5Zfletcher32.c ++++ b/src/H5Zfletcher32.c +@@ -62,6 +62,14 @@ H5Z__filter_fletcher32(unsigned flags, size_t H5_ATTR_UNUSED cd_nelmts, + assert(sizeof(uint32_t) >= 4); + + if (flags & H5Z_FLAG_REVERSE) { /* Read */ ++ /* A Fletcher32-filtered buffer must contain at least the trailing ++ * checksum. Reject anything smaller to avoid a size_t underflow ++ * when computing the data length. ++ */ ++ if (nbytes < FLETCHER_LEN) ++ HGOTO_ERROR(H5E_STORAGE, H5E_OVERFLOW, 0, ++ "fletcher32 filter input buffer too small to contain checksum"); ++ + /* Do checksum if it's enabled for read; otherwise skip it + * to save performance. */ + if (!(flags & H5Z_FLAG_SKIP_EDC)) { +diff --git a/src/H5Znbit.c b/src/H5Znbit.c +index fed86a1a3bd..ce8c726370a 100644 +--- a/src/H5Znbit.c ++++ b/src/H5Znbit.c +@@ -51,26 +51,29 @@ static herr_t H5Z__set_parms_compound(const H5T_t *type, unsigned *cd_values_ind + bool *need_not_compress); + + static void H5Z__nbit_next_byte(size_t *j, size_t *buf_len); +-static void H5Z__nbit_decompress_one_byte(unsigned char *data, size_t data_offset, unsigned k, ++static herr_t H5Z__nbit_decompress_one_byte(unsigned char *data, size_t data_offset, unsigned k, + unsigned begin_i, unsigned end_i, const unsigned char *buffer, +- size_t *j, size_t *buf_len, const parms_atomic *p, +- size_t datatype_len); ++ size_t buffer_size, size_t *j, size_t *buf_len, ++ const parms_atomic *p, size_t datatype_len); + static void H5Z__nbit_compress_one_byte(const unsigned char *data, size_t data_offset, unsigned k, + unsigned begin_i, unsigned end_i, unsigned char *buffer, size_t *j, + size_t *buf_len, const parms_atomic *p, size_t datatype_len); +-static void H5Z__nbit_decompress_one_nooptype(unsigned char *data, size_t data_offset, +- const unsigned char *buffer, size_t *j, size_t *buf_len, +- unsigned size); +-static void H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigned char *buffer, +- size_t *j, size_t *buf_len, const parms_atomic *p); ++static herr_t H5Z__nbit_decompress_one_nooptype(unsigned char *data, size_t data_offset, ++ const unsigned char *buffer, size_t buffer_size, size_t *j, ++ size_t *buf_len, unsigned size); ++static herr_t H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigned char *buffer, ++ size_t buffer_size, size_t *j, size_t *buf_len, ++ const parms_atomic *p); + static herr_t H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned char *buffer, +- size_t *j, size_t *buf_len, const unsigned parms[], ++ size_t buffer_size, size_t *j, size_t *buf_len, ++ const unsigned parms[], size_t parms_nelmts, + unsigned *parms_index); + static herr_t H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, +- unsigned char *buffer, size_t *j, size_t *buf_len, +- const unsigned parms[], unsigned *parms_index); ++ unsigned char *buffer, size_t buffer_size, size_t *j, ++ size_t *buf_len, const unsigned parms[], size_t parms_nelmts, ++ unsigned *parms_index); + static herr_t H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer, +- const unsigned parms[]); ++ size_t buffer_size, const unsigned parms[], size_t parms_nelmts); + static void H5Z__nbit_compress_one_nooptype(const unsigned char *data, size_t data_offset, + unsigned char *buffer, size_t *j, size_t *buf_len, unsigned size); + static void H5Z__nbit_compress_one_array(unsigned char *data, size_t data_offset, unsigned char *buffer, +@@ -100,8 +103,15 @@ H5Z_class2_t H5Z_NBIT[1] = {{ + #define H5Z_NBIT_COMPOUND 3 /* Compound datatype class */ + #define H5Z_NBIT_NOOPTYPE 4 /* Other datatype class: nbit does no compression */ + #define H5Z_NBIT_MAX_NPARMS 4096 /* Max number of parameters for filter */ +-#define H5Z_NBIT_ORDER_LE 0 /* Little endian for datatype byte order */ +-#define H5Z_NBIT_ORDER_BE 1 /* Big endian for datatype byte order */ ++ ++/* Whether the parameter list holds N more values starting at IDX. The ++ * datatype description that drives the walk through the parameters is held in ++ * those same parameters, so a list that stops short of the datatype it ++ * describes has to be caught at each step rather than measured up front. ++ */ ++#define H5Z_NBIT_PARMS_AVAIL(idx, n, nelmts) (((nelmts) >= (n)) && ((size_t)(idx) <= (nelmts) - (n))) ++#define H5Z_NBIT_ORDER_LE 0 /* Little endian for datatype byte order */ ++#define H5Z_NBIT_ORDER_BE 1 /* Big endian for datatype byte order */ + + /* Local variables */ + +@@ -931,7 +941,16 @@ H5Z__filter_nbit(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + + /* check arguments + * cd_values[0] stores actual number of parameters in cd_values[] ++ * ++ * The filter header always occupies cd_values[0..4] (number of ++ * parameters, no-compression flag, number of elements, datatype class ++ * and datatype size), all of which are read unconditionally below. ++ * Reject a NULL array or one shorter than that to avoid a bad ++ * dereference. + */ ++ if (cd_values == NULL || cd_nelmts < 5) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "invalid nbit parameters"); ++ + if (cd_nelmts != cd_values[0]) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "invalid nbit aggression level"); + +@@ -944,6 +963,18 @@ H5Z__filter_nbit(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + /* copy a filter parameter to d_nelmts */ + d_nelmts = cd_values[2]; + ++ /* cd_values[4] stores the datatype size, which is used together with ++ * d_nelmts to size the (de)compression buffer. A zero size is invalid, ++ * and a d_nelmts * size product that overflows size_t would produce an ++ * undersized allocation and out-of-bounds accesses (this matters on ++ * platforms with a 32-bit size_t). Reject both, as they can only arise ++ * from a corrupted or crafted file. ++ */ ++ if (cd_values[4] == 0) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "invalid nbit datatype size"); ++ if (d_nelmts != 0 && (size_t)cd_values[4] > SIZE_MAX / d_nelmts) ++ HGOTO_ERROR(H5E_ARGS, H5E_OVERFLOW, 0, "nbit (de)compression buffer size overflow"); ++ + /* input; decompress */ + if (flags & H5Z_FLAG_REVERSE) { + size_out = d_nelmts * (size_t)cd_values[4]; /* cd_values[4] stores datatype size */ +@@ -953,7 +984,7 @@ H5Z__filter_nbit(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "memory allocation failed for nbit decompression"); + + /* decompress the buffer */ +- if (H5Z__nbit_decompress(outbuf, d_nelmts, (unsigned char *)*buf, cd_values) < 0) { ++ if (H5Z__nbit_decompress(outbuf, d_nelmts, (unsigned char *)*buf, nbytes, cd_values, cd_nelmts) < 0) { + H5MM_xfree(outbuf); + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, 0, "can't decompress buffer"); + } +@@ -999,15 +1030,19 @@ H5Z__nbit_next_byte(size_t *j, size_t *buf_len) + *buf_len = 8 * sizeof(unsigned char); + } + +-static void ++static herr_t + H5Z__nbit_decompress_one_byte(unsigned char *data, size_t data_offset, unsigned k, unsigned begin_i, +- unsigned end_i, const unsigned char *buffer, size_t *j, size_t *buf_len, +- const parms_atomic *p, size_t datatype_len) ++ unsigned end_i, const unsigned char *buffer, size_t buffer_size, size_t *j, ++ size_t *buf_len, const parms_atomic *p, size_t datatype_len) + { + size_t dat_len; /* dat_len is the number of bits to be copied in each data byte */ + size_t dat_offset; + unsigned char val; /* value to be copied in each data byte */ + ++ /* Ensure the byte to be read is within the bounds of the compressed buffer */ ++ if (*j >= buffer_size) ++ return FAIL; ++ + /* initialize value and bits of unsigned char to be copied */ + val = buffer[*j]; + dat_offset = 0; +@@ -1039,25 +1074,33 @@ H5Z__nbit_decompress_one_byte(unsigned char *data, size_t data_offset, unsigned + dat_len -= *buf_len; + H5Z__nbit_next_byte(j, buf_len); + if (dat_len == 0) +- return; ++ return SUCCEED; + ++ if (*j >= buffer_size) ++ return FAIL; + val = buffer[*j]; + data[data_offset + k] |= (unsigned char)(((unsigned)(val >> (*buf_len - dat_len)) & + (unsigned)(~((unsigned)(~0) << dat_len))) + << dat_offset); + *buf_len -= dat_len; + } ++ ++ return SUCCEED; + } + +-static void ++static herr_t + H5Z__nbit_decompress_one_nooptype(unsigned char *data, size_t data_offset, const unsigned char *buffer, +- size_t *j, size_t *buf_len, unsigned size) ++ size_t buffer_size, size_t *j, size_t *buf_len, unsigned size) + { + unsigned i; /* index */ + size_t dat_len; /* dat_len is the number of bits to be copied in each data byte */ + unsigned char val; /* value to be copied in each data byte */ + + for (i = 0; i < size; i++) { ++ /* Ensure the byte to be read is within the bounds of the compressed buffer */ ++ if (*j >= buffer_size) ++ return FAIL; ++ + /* initialize value and bits of unsigned char to be copied */ + val = buffer[*j]; + dat_len = sizeof(unsigned char) * 8; +@@ -1069,16 +1112,20 @@ H5Z__nbit_decompress_one_nooptype(unsigned char *data, size_t data_offset, const + if (dat_len == 0) + continue; + ++ if (*j >= buffer_size) ++ return FAIL; + val = buffer[*j]; + data[data_offset + i] |= (unsigned char)((unsigned)(val >> (*buf_len - dat_len)) & + (unsigned)(~((unsigned)(~0) << dat_len))); + *buf_len -= dat_len; + } ++ ++ return SUCCEED; + } + +-static void +-H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigned char *buffer, size_t *j, +- size_t *buf_len, const parms_atomic *p) ++static herr_t ++H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigned char *buffer, ++ size_t buffer_size, size_t *j, size_t *buf_len, const parms_atomic *p) + { + /* begin_i: the index of byte having first significant bit + end_i: the index of byte having last significant bit */ +@@ -1097,8 +1144,9 @@ H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigne + end_i = p->offset / 8; + + for (k = (int)begin_i; k >= (int)end_i; k--) +- H5Z__nbit_decompress_one_byte(data, data_offset, (unsigned)k, begin_i, end_i, buffer, j, buf_len, +- p, datatype_len); ++ if (H5Z__nbit_decompress_one_byte(data, data_offset, (unsigned)k, begin_i, end_i, buffer, ++ buffer_size, j, buf_len, p, datatype_len) < 0) ++ return FAIL; + } + else { /* big endian */ + /* Sanity check */ +@@ -1112,14 +1160,18 @@ H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigne + end_i = ((unsigned)datatype_len - p->offset) / 8 - 1; + + for (k = (int)begin_i; k <= (int)end_i; k++) +- H5Z__nbit_decompress_one_byte(data, data_offset, (unsigned)k, begin_i, end_i, buffer, j, buf_len, +- p, datatype_len); ++ if (H5Z__nbit_decompress_one_byte(data, data_offset, (unsigned)k, begin_i, end_i, buffer, ++ buffer_size, j, buf_len, p, datatype_len) < 0) ++ return FAIL; + } ++ ++ return SUCCEED; + } + + static herr_t +-H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned char *buffer, size_t *j, +- size_t *buf_len, const unsigned parms[], unsigned *parms_index) ++H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned char *buffer, ++ size_t buffer_size, size_t *j, size_t *buf_len, const unsigned parms[], ++ size_t parms_nelmts, unsigned *parms_index) + { + unsigned i, total_size, base_class, base_size, n, begin_index; + parms_atomic p; +@@ -1127,11 +1179,19 @@ H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned + + FUNC_ENTER_PACKAGE + ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 2, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + total_size = parms[(*parms_index)++]; + base_class = parms[(*parms_index)++]; + + switch (base_class) { + case H5Z_NBIT_ATOMIC: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 4, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + p.size = parms[(*parms_index)++]; + p.order = parms[(*parms_index)++]; + p.precision = parms[(*parms_index)++]; +@@ -1143,37 +1203,54 @@ H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned + + n = total_size / p.size; + for (i = 0; i < n; i++) +- H5Z__nbit_decompress_one_atomic(data, data_offset + i * (size_t)p.size, buffer, j, buf_len, +- &p); ++ if (H5Z__nbit_decompress_one_atomic(data, data_offset + i * (size_t)p.size, buffer, ++ buffer_size, j, buf_len, &p) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress atomic"); + break; + + case H5Z_NBIT_ARRAY: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 1, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + base_size = parms[*parms_index]; /* read in advance */ + n = total_size / base_size; /* number of base_type elements inside the array datatype */ + begin_index = *parms_index; + for (i = 0; i < n; i++) { +- if (H5Z__nbit_decompress_one_array(data, data_offset + i * (size_t)base_size, buffer, j, +- buf_len, parms, parms_index) < 0) ++ if (H5Z__nbit_decompress_one_array(data, data_offset + i * (size_t)base_size, buffer, ++ buffer_size, j, buf_len, parms, parms_nelmts, ++ parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array"); + *parms_index = begin_index; + } + break; + + case H5Z_NBIT_COMPOUND: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 1, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + base_size = parms[*parms_index]; /* read in advance */ + n = total_size / base_size; /* number of base_type elements inside the array datatype */ + begin_index = *parms_index; + for (i = 0; i < n; i++) { +- if (H5Z__nbit_decompress_one_compound(data, data_offset + i * (size_t)base_size, buffer, j, +- buf_len, parms, parms_index) < 0) ++ if (H5Z__nbit_decompress_one_compound(data, data_offset + i * (size_t)base_size, buffer, ++ buffer_size, j, buf_len, parms, parms_nelmts, ++ parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound"); + *parms_index = begin_index; + } + break; + + case H5Z_NBIT_NOOPTYPE: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 1, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + (*parms_index)++; /* skip size of no-op type */ +- H5Z__nbit_decompress_one_nooptype(data, data_offset, buffer, j, buf_len, total_size); ++ if (H5Z__nbit_decompress_one_nooptype(data, data_offset, buffer, buffer_size, j, buf_len, ++ total_size) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress no-op type"); + break; + + default: +@@ -1185,8 +1262,9 @@ done: + } + + static herr_t +-H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsigned char *buffer, size_t *j, +- size_t *buf_len, const unsigned parms[], unsigned *parms_index) ++H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsigned char *buffer, ++ size_t buffer_size, size_t *j, size_t *buf_len, const unsigned parms[], ++ size_t parms_nelmts, unsigned *parms_index) + { + unsigned i, nmembers, member_offset, member_class, member_size, used_size = 0, prev_used_size, size; + parms_atomic p; +@@ -1194,10 +1272,18 @@ H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsig + + FUNC_ENTER_PACKAGE + ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 2, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + size = parms[(*parms_index)++]; + nmembers = parms[(*parms_index)++]; + + for (i = 0; i < nmembers; i++) { ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 3, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + member_offset = parms[(*parms_index)++]; + member_class = parms[(*parms_index)++]; + +@@ -1213,6 +1299,10 @@ H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsig + HGOTO_ERROR(H5E_PLINE, H5E_BADRANGE, FAIL, "compound member offset overflowed compound size"); + switch (member_class) { + case H5Z_NBIT_ATOMIC: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 4, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + p.size = member_size; + /* Advance past member size */ + (*parms_index)++; +@@ -1224,26 +1314,29 @@ H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsig + if (p.precision > p.size * 8 || (p.precision + p.offset) > p.size * 8) + HGOTO_ERROR(H5E_PLINE, H5E_BADTYPE, FAIL, "invalid datatype precision/offset"); + +- H5Z__nbit_decompress_one_atomic(data, data_offset + member_offset, buffer, j, buf_len, &p); ++ if (H5Z__nbit_decompress_one_atomic(data, data_offset + member_offset, buffer, buffer_size, j, ++ buf_len, &p) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress atomic"); + break; + + case H5Z_NBIT_ARRAY: +- if (H5Z__nbit_decompress_one_array(data, data_offset + member_offset, buffer, j, buf_len, +- parms, parms_index) < 0) ++ if (H5Z__nbit_decompress_one_array(data, data_offset + member_offset, buffer, buffer_size, j, ++ buf_len, parms, parms_nelmts, parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array"); + break; + + case H5Z_NBIT_COMPOUND: +- if (H5Z__nbit_decompress_one_compound(data, data_offset + member_offset, buffer, j, buf_len, +- parms, parms_index) < 0) ++ if (H5Z__nbit_decompress_one_compound(data, data_offset + member_offset, buffer, buffer_size, ++ j, buf_len, parms, parms_nelmts, parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound"); + break; + + case H5Z_NBIT_NOOPTYPE: +- /* Advance past member size */ ++ /* Advance past member size (already checked above) */ + (*parms_index)++; +- H5Z__nbit_decompress_one_nooptype(data, data_offset + member_offset, buffer, j, buf_len, +- member_size); ++ if (H5Z__nbit_decompress_one_nooptype(data, data_offset + member_offset, buffer, buffer_size, ++ j, buf_len, member_size) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress no-op type"); + break; + + default: +@@ -1256,7 +1349,8 @@ done: + } + + static herr_t +-H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer, const unsigned parms[]) ++H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer, size_t buffer_size, ++ const unsigned parms[], size_t parms_nelmts) + { + /* i: index of data, j: index of buffer, + buf_len: number of bits to be filled in current byte */ +@@ -1269,6 +1363,11 @@ H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buff + + FUNC_ENTER_PACKAGE + ++ /* The datatype class and its size are read before the walk begins */ ++ if (!H5Z_NBIT_PARMS_AVAIL(0, 5, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + /* may not have to initialize to zeros */ + memset(data, 0, d_nelmts * (size_t)parms[4]); + +@@ -1278,6 +1377,10 @@ H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buff + + switch (parms[3]) { + case H5Z_NBIT_ATOMIC: ++ if (!H5Z_NBIT_PARMS_AVAIL(0, 8, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + p.size = parms[4]; + p.order = parms[5]; + p.precision = parms[6]; +@@ -1288,15 +1391,17 @@ H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buff + HGOTO_ERROR(H5E_PLINE, H5E_BADTYPE, FAIL, "invalid datatype precision/offset"); + + for (i = 0; i < d_nelmts; i++) +- H5Z__nbit_decompress_one_atomic(data, i * (size_t)p.size, buffer, &j, &buf_len, &p); ++ if (H5Z__nbit_decompress_one_atomic(data, i * (size_t)p.size, buffer, buffer_size, &j, ++ &buf_len, &p) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress atomic"); + break; + + case H5Z_NBIT_ARRAY: + size = parms[4]; + parms_index = 4; /* set the index before goto function call */ + for (i = 0; i < d_nelmts; i++) { +- if (H5Z__nbit_decompress_one_array(data, i * size, buffer, &j, &buf_len, parms, +- &parms_index) < 0) ++ if (H5Z__nbit_decompress_one_array(data, i * size, buffer, buffer_size, &j, &buf_len, parms, ++ parms_nelmts, &parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array"); + parms_index = 4; + } +@@ -1306,8 +1411,8 @@ H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buff + size = parms[4]; + parms_index = 4; /* set the index before goto function call */ + for (i = 0; i < d_nelmts; i++) { +- if (H5Z__nbit_decompress_one_compound(data, i * size, buffer, &j, &buf_len, parms, +- &parms_index) < 0) ++ if (H5Z__nbit_decompress_one_compound(data, i * size, buffer, buffer_size, &j, &buf_len, ++ parms, parms_nelmts, &parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound"); + parms_index = 4; + } diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 4e493f0aa7..90a0e5c066 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -22,6 +22,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-17573.patch \ file://CVE-2026-17574.patch \ file://CVE-2026-19025.patch \ + file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 20:05:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103171 Received: from mail-dl1-f43.google.com (mail-dl1-f43.google.com [74.125.82.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5088.1793909162033733673 for ; Thu, 05 Nov 2026 12:06:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=zYajprXh; spf=pass (domain: gmail.com, ip: 74.125.82.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f43.google.com with SMTP id a92af1059eb24-14394530ec6so3153382c88.1 for ; Thu, 05 Nov 2026 12:06:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909161; x=1794513961; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XrBHGw2hgW9iV7B2O9qA01jbS3nYj6KQngb8WY2vPP8=; b=zYajprXhg6x2QFSM+7+u1Mo+1VOf6bihFC4WZVZJalq9PrcfH8urQfeSTc9hWvrB/G xjNn65nfMpEYxGQI0Jpl7nzjItbR2pOSBOhBzQRZNc0m3QizqoIlsXjLN09+lXxyYJcQ aozTgrBRJObUH1MLXlvA0+b8aGxBdyMOzdJsWTBYYQgrlmklkv5623EsiI7A3cop/pjB K3tmmXIKX6hqL6dBKDojJVrMUGSxGyi1dG+KUCo/7MVvsBAPeG9W6XxB+rnwhprxfiiF rZlRX8D5wL//K1zRw9DEaP4uiFciSWWYEczqMH46Bl7vyssCkwJxq61ZVqPwwACJ7G2h 15xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909161; x=1794513961; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=XrBHGw2hgW9iV7B2O9qA01jbS3nYj6KQngb8WY2vPP8=; b=fYZPbA6oLdgr2whH+Jl26H93tEQAEC/pC2DtookmqW1nt/JWou4jII2uj8rZWssQpa lMp0LhzZg1PQd1y3zCvGHcGj0nyK1OIcvWrgHCi6A5yYv6wY6ofmH+ZBOAdSRECYuwEt HEJebHaNvNk837BK71HFTRt9vt9TC4NBtcri+t24VswnI6o6ieGf52H5asyWJi9IiBZ5 S63OOnmeYl6gwV5p/pjHqigistFSLYvrAniO34a9+DDBmtq/kn8YpcDXeXnvPsM77YjY AjOoFgc94L5eQKiDfqnnD5jdPm57gwCIVVkWae1EcpQb57Yom8lG2+mPtTfg/GtBtXIQ 8Snw== X-Gm-Message-State: APuU4Z+BbO9JtaV0+KgyvgvtSUysj4houtYqEF9Lb2g13NYu787avv7l YYiSU4pGmcrU5i193hz3or8nMP4nzc1YYnTEKrxd7tUW6Fr4PikvYfwp5OCEJA== X-Gm-Gg: AYBFou2raOvpd62VLsfxN1+thZW43WMlegiILMepOI5YpRik6nJes0ELJWZLzZvdnwo d8GjnNmp1KAzKCgLRpzYexvoqWuzbeVYb2DV5QW+MxUOx9mFIJQMWLGWOYNEuF5WYiH//Gt5/Wk MoxRY9RcFYszWHfybbaAlz5YizF4+tTxHwdyzfrMI/CCR7ifAlgDqcv2h9ARX61DdPRMvnZrVk2 NIXMfJvs8vAoL1zMHulC8jVsuNN8s+k1jXBP43bnOhAmGieHjit+iTRaC61Gw1rv8muOkorOv9d VS1upKkcmLu+Q2PwVH/uiC4GvhczzayT4E1wQ6Fwrbpsq4lzN7ciRAN1b/HUSVQEt+APdmFqeRd uWWD62jgKdbZsuHIY5GXGf4+dSvU4KLG5bi/7woJXGPpdwY01w3vbWwmeOQC7Lf4PQ8nEVae0SJ HvGrt5gfu3an7uN9/WHrQz5vKJ3i5ZGcoon4cmDqMX3tk0GqHIhRgXgj3w77wEp8YDVcgsfzP8j FPxJhu/Kh8gxcwYhressIdkVF3NhiWRCzmRcjJ7+yWYlMcVn2Vs+/fgyVjoOwuczRekdBMBPkgO eB3Ih0lH90alQ0ug9yfsHcgI6gzCdM2Cex9/Quzf4SAdurldbVvWyaBKgiQmPg== X-Received: by 2002:a05:701b:4251:10b0:16a:1fa:58cb with SMTP id a92af1059eb24-1b25d287191mr112203c88.1.1793909161100; Thu, 05 Nov 2026 12:06:01 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.05.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:06:00 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 2/9] hdf5: patch CVE-2026-19023 and CVE-2026-19024 Date: Fri, 6 Nov 2026 09:05:45 +1300 Message-ID: <20261105200552.81303-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105200552.81303-1-ankur.tyagi85@gmail.com> References: <20261105200552.81303-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131930 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-19023 https://nvd.nist.gov/vuln/detail/cve-2026-19024 Signed-off-by: Ankur Tyagi --- .../files/CVE-2026-19023-CVE-2026-19024.patch | 176 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 177 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19023-CVE-2026-19024.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19023-CVE-2026-19024.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19023-CVE-2026-19024.patch new file mode 100644 index 0000000000..acf3817ea1 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19023-CVE-2026-19024.patch @@ -0,0 +1,176 @@ +From e7e85949865b771b2b0b73ac1edaf54ce14cd894 Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Wed, 7 Oct 2026 11:03:55 -0500 +Subject: [PATCH] Fix CVEs related to vlen binary output and malformed fill + values in h5dump (#6507) + +* Fix h5dump SIGSEGVs on vlen binary output and malformed fill value + +Fixes two crafted-file crashes in h5dump (GitHub issues #6486 and #6487). +A third report (#6488) is the Fletcher32 checksum-length underflow already +fixed for h5ls in PR #6497, so it is not addressed again here. + +Issue #6486 (tools) - render_bin_output() SIGSEGV with "-b" on a +variable-length string dataset. The H5T_STRING branch reused the local +"size" variable both as the per-element stride and as the string length +returned by strlen(), so after the first element the stride became that +string's length and subsequent elements were read from misaligned +addresses, dereferencing a garbage pointer. This affected any multi-element +vlen-string dataset, not just crafted files. A separate str_len variable is +now used for the write length so "size" stays the datatype stride. As this +is a tools bug, the regression test is a tools test: tools/test/h5dump adds +the tbinvlstr case (binary dump of a vlen-string dataset, file +tbinvlstr.h5, generated by h5dumpgentest.c/gent_binvlstr), which crashes on +develop and passes with the fix. + +Issue #6487 (library) - H5Pget_fill_value() SIGSEGV via H5T_path_find(). +A crafted version-1/2 fill value message can have "fill defined" set with a +negative size field; H5O_fill_old_decode() leaves fill.size negative and +fill.buf/type NULL instead of normalizing to the "undefined" sentinel. +That value is neither 0 nor -1, so H5P_get_fill_value() fell through to +H5T_path_find() with a NULL source type and crashed. H5P_get_fill_value() +now rejects a NULL fill datatype and returns an error, keeping the dataset +itself readable. h5dump's XML fill-value renderer (xml_dump_fill_value) is +also hardened: it checks the buffer allocation and the H5Pget_fill_value() +return value and emits an empty fill value element instead of dereferencing +an unallocated or unretrievable buffer. + +Regression test (library): test/fillval.c test_bad_fill_value() reads a +crafted file (generated by test/gen_bad_fill.c, committed as +test/testfiles/bad_fill_value.h5) and verifies that the dataset data is +still readable while H5Pget_fill_value() fails cleanly instead of crashing. + +Verified: both PoCs exit cleanly with the fix (SIGSEGV without it); the +committed fixtures crash the pre-fix library/tools and pass post-fix; the +fillval suite, the new tbinvlstr h5dump test, and the non-XML h5dump suite +pass. + +Co-Authored-By: Claude Opus 4.8 + +* Update CHANGELOG to list CVEs/GH issues + +* Renumber tbinvlstr.h5 generator macro to FILE114 + +--------- + +Co-authored-by: Claude Opus 4.8 +Co-authored-by: Larry Knox + +CVE: CVE-2026-19023 CVE-2026-19024 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/cfcd7fe7421cc94e0527d043f2d1b271986e7b09] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Pdcpl.c | 7 +++++++ + tools/lib/h5tools.c | 9 ++++++--- + tools/src/h5dump/h5dump_xml.c | 33 ++++++++++++++++++++++++++++----- + 3 files changed, 41 insertions(+), 8 deletions(-) + +diff --git a/src/H5Pdcpl.c b/src/H5Pdcpl.c +index 2317c317f73..a1a33d52c7b 100644 +--- a/src/H5Pdcpl.c ++++ b/src/H5Pdcpl.c +@@ -3207,6 +3207,13 @@ H5P_get_fill_value(H5P_genplist_t *plist, const H5T_t *type, void *value /*out*/ + HGOTO_DONE(SUCCEED); + } /* end if */ + ++ /* ++ * A fill value with a nonzero size must have an associated datatype in ++ * order to be converted to the destination type. ++ */ ++ if (NULL == fill.type) ++ HGOTO_ERROR(H5E_PLIST, H5E_CANTGET, FAIL, "fill value has no datatype"); ++ + /* + * Can we convert between the source and destination datatypes? + */ +diff --git a/tools/lib/h5tools.c b/tools/lib/h5tools.c +index b1a2aa0de4c..3e028504f7c 100644 +--- a/tools/lib/h5tools.c ++++ b/tools/lib/h5tools.c +@@ -1825,24 +1825,27 @@ render_bin_output(FILE *stream, hid_t container, hid_t tid, void *_mem, hsize_t + H5T_str_t pad; + char *s = NULL; + unsigned char tempuchar; ++ size_t str_len; /* # of bytes to write for this element */ + + H5TOOLS_DEBUG("H5T_STRING"); + pad = H5Tget_strpad(tid); + + for (block_index = 0; block_index < block_nelmts; block_index++) { ++ /* Advance by the datatype size */ + mem = ((unsigned char *)_mem) + block_index * size; + + if (H5Tis_variable_str(tid)) { + s = *(char **)((void *)mem); + if (s != NULL) +- size = strlen(s); ++ str_len = strlen(s); + else + H5TOOLS_THROW((-1), "NULL string"); + } + else { +- s = (char *)mem; ++ s = (char *)mem; ++ str_len = size; + } +- for (i = 0; i < size && (s[i] || pad != H5T_STR_NULLTERM); i++) { ++ for (i = 0; i < str_len && (s[i] || pad != H5T_STR_NULLTERM); i++) { + memcpy(&tempuchar, &s[i], sizeof(unsigned char)); + if (1 != fwrite(&tempuchar, sizeof(unsigned char), 1, stream)) + H5TOOLS_THROW((-1), "fwrite failed"); +diff --git a/tools/src/h5dump/h5dump_xml.c b/tools/src/h5dump/h5dump_xml.c +index f1a34870f4a..6f3e00a27df 100644 +--- a/tools/src/h5dump/h5dump_xml.c ++++ b/tools/src/h5dump/h5dump_xml.c +@@ -3534,8 +3534,9 @@ xml_dump_fill_value(hid_t dcpl, hid_t type) + hid_t n_type = H5I_INVALID_HID; + void *buf; + char *name; +- h5tools_str_t buffer; /* string into which to render */ +- h5tools_context_t ctx; /* print context */ ++ herr_t fill_ret = FAIL; /* status of retrieving the fill value */ ++ h5tools_str_t buffer; /* string into which to render */ ++ h5tools_context_t ctx; /* print context */ + h5tool_format_t *outputformat = &xml_dataformat; + h5tool_format_t string_dataformat; + hsize_t curr_pos = 0; /* total data element position */ +@@ -3593,11 +3594,33 @@ xml_dump_fill_value(hid_t dcpl, hid_t type) + n_type = type; + + space = H5Tget_size(n_type); +- buf = malloc((size_t)space); ++ /* Zero-initialize so a partially-filled buffer never contains ++ * uninitialized memory for the rendering code below. */ ++ buf = calloc((size_t)space, 1); ++ ++ /* Retrieve the fill value. This can fail on a corrupted or crafted file ++ * whose fill value has no datatype. Any errors are suppressed and handled ++ * later. */ ++ if (buf != NULL) { ++ H5E_BEGIN_TRY ++ { ++ fill_ret = H5Pget_fill_value(dcpl, n_type, buf); ++ } ++ H5E_END_TRY ++ } + +- H5Pget_fill_value(dcpl, n_type, buf); ++ if (buf == NULL || fill_ret < 0) { ++ /* No usable fill value: emit an empty element rather than ++ * dereferencing an unallocated or unretrievable buffer. */ ++ ctx.need_prefix = true; + +- if (H5Tget_class(n_type) == H5T_REFERENCE) { ++ /* Render the element */ ++ h5tools_str_reset(&buffer); ++ h5tools_str_append(&buffer, "<%sNoData />", xmlnsprefix); ++ h5tools_render_element(rawoutstream, outputformat, &ctx, &buffer, &curr_pos, ++ (size_t)outputformat->line_ncols, (hsize_t)0, (hsize_t)0); ++ } ++ else if (H5Tget_class(n_type) == H5T_REFERENCE) { + const char *path = lookup_ref_path(*(H5R_ref_t *)buf); + + ctx.need_prefix = true; diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 90a0e5c066..b8e5101e41 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -23,6 +23,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-17574.patch \ file://CVE-2026-19025.patch \ file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ + file://CVE-2026-19023-CVE-2026-19024.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 20:05:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103165 Received: from mail-dl1-f42.google.com (mail-dl1-f42.google.com [74.125.82.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5192.1793909163948705966 for ; Thu, 05 Nov 2026 12:06:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=kQW37bJK; spf=pass (domain: gmail.com, ip: 74.125.82.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f42.google.com with SMTP id a92af1059eb24-15ea896ddc8so3844139c88.0 for ; Thu, 05 Nov 2026 12:06:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909163; x=1794513963; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aXbGcajQXmz39fGjtvzWrGNUZE7Num+wRUH1I+JpF6M=; b=kQW37bJKKgefHObuW3EMGv6lJqRT+cTFl/U7tLXSZ741f508X/d2g+bpgkESCBQT5y HUGRGT3t1JVGNwzCsv5lj10DCyEjkCLlxNsBHe3+VaMzjNHuzVpN5lLB9nBnHDpKVp2X 5eSmLt3V4ziCeNrzDgnMOl+wTOy1hAg+SzQ1ojTKgJCN6Sg8f5VFLYFeo7By0NOzKaZv b7Om08i2iabP+Q63VVEWsVR3FOieZhZtwvHNwTkuEwPj/sSsznQoS+s6nQ/JC50l5wlm c2mXoD9iYEhQ0rxLTqkMGQyWsdidgsivK4Ep4bVqDDHAaEJI9OKtDgXvjTQuncl4DMSw 3jGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909163; x=1794513963; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aXbGcajQXmz39fGjtvzWrGNUZE7Num+wRUH1I+JpF6M=; b=yZOI0PIMmOPcY44LyezddxIv8q4uxnNFuNAMusu3n+NZ6Qqedw46L5aJmw+Wyj0prv BJ+yandYZPJeJiVHyEHTUO2M32o6sluSDNbRBa0fRbieBdLXOMGCqLhg9Y/7T9ve0gZf UsUqsoXjAGR9nWRpljrfkXspYoQFu8wbeJaWq+oVtvqncrev0uGzVQnSkbla1//63nno 9iBYTSuPp408xuqk1uTKTm1oPINKsktVuVu2NTogFxgiS9UY9n/OZBhR2Zqosy0agdYg ECJEi81994WcgMFmZNBlJuOqxy4K98aR3mugCs9Ouwrgs4WBoByKRzgOz7gjGRfJXOi5 9tdw== X-Gm-Message-State: APuU4Z+GYgnEwvO9Ti1u2nPGebON5Y34gMzd1TXtMdvfpjdd0UYO8nSd 1cm7yJBJUFVzsMW1+RhQLBTlin5v6x4gVG2+RF3jSpG+5QlL0vq/mo/WeUc1GQ== X-Gm-Gg: AYBFou2e6y3JaTF84+5sBSgIhCK65Sfr4uRw9uU0iBRTc8n1YsYkq+o0AGfGlkv2vbV MwsiK/YP38bfbW0jEJkzuG3EDM0fg4P5GMRnw+K1bDumQKj9LkUHHXG17iB0W0ygL3JoUAcf8GM lb6wiHn0Vf62P0G7mb+u90+v8ZTk+F0ggHvffNICkDEAlQxqJgl46ic254h0eX2swOPXvEtVvmh e5hQgiICJjkj5Q2BHAQ2BooigPEiOtaGRA09EXmxyKFyehswRR+2FP2Hs3R+D8da6K0eWib4Wcl bYH9tAN8kMIieOqVeIHu4plTv8JIg+8BJxU0nijt+2XDmAG0S0LXpp/sQMHebKgycddiOk+pCrk IFwE7StNSOYIklizVUvlnaveTJzHW33k1/ge4pE8DYnbZGC+RE5M3V0dcFcKUbJ74RlV7k9bGqG eNxnC8a2F9rM3kDpzFXuz6H7A6i8/aiV46MrvGEimhjLJvJdxEoLeZ6AARrR5OvGQZ4eVuduvBi 9l4wz+jnR1amiMJX3p4vTLMPHmsqnkURW8nf4U9BTR723DevBcoELyQ2KGg+RyjT3iqlHhu31Rd Zaj3YrAAJcXFVy8tofnzKi8n1IJkDpYM08A5CHuL8eLKv3NcpP8sh6SdfNbM8A== X-Received: by 2002:a05:7022:eac9:b0:1b2:3bdb:35cb with SMTP id a92af1059eb24-1b25d2f73b8mr101254c88.11.1793909163076; Thu, 05 Nov 2026 12:06:03 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.06.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:06:02 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 3/9] hdf5: patch CVE-2026-120689 Date: Fri, 6 Nov 2026 09:05:46 +1300 Message-ID: <20261105200552.81303-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105200552.81303-1-ankur.tyagi85@gmail.com> References: <20261105200552.81303-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131931 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120689 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-120689.patch | 60 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch new file mode 100644 index 0000000000..dd9e9374ac --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch @@ -0,0 +1,60 @@ +From 0472315404dc03d0e89eec4513eb80930f9b176e Mon Sep 17 00:00:00 2001 +From: PGZXB <420254146@qq.com> +Date: Fri, 9 Oct 2026 02:52:55 +0800 +Subject: [PATCH] Fix StackOverflow when calling `H5Gget_info` (#6685) + +Verify B-tree node level when an expected level value is provided + +(cherry picked from commit 5933130b610c7bd6e66fe93c2798b97e3f3188c8) + +CVE: CVE-2026-120689 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/5933130b610c7bd6e66fe93c2798b97e3f3188c8] + +Signed-off-by: Ankur Tyagi +--- + release_docs/CHANGELOG.md | 6 ++++++ + src/H5B.c | 14 ++++++++++++++ + 2 files changed, 20 insertions(+) + +diff --git a/release_docs/CHANGELOG.md b/release_docs/CHANGELOG.md +index c181f174bbb..b5c99cd4b16 100644 +--- a/release_docs/CHANGELOG.md ++++ b/release_docs/CHANGELOG.md +@@ -778,6 +778,12 @@ Added Fortran wrapper `h5fdsubfiling_get_file_mapping_f()` for the subfiling fil + + A malformed HDF5 file could have an attribute with a recorded name length of zero.This would lead to an overflow and an invalid memory access. An integrity check has been added to detect this case and safely stop file decoding. + ++### Fixed a stack overflow when iterating a corrupted B-tree ++ ++ `H5B__iterate_helper()` now verifies that a B-tree node it has just protected has the level the traversal expects, when the expected level is known. The equivalent check in `H5B__cache_deserialize()` only runs when a node is first loaded into the metadata cache, so a corrupted B-tree whose child pointer revisits a node that is already cached (for example, a node that points to itself) could bypass that check and recurse without bound until the stack was exhausted. Such a file is now rejected with an error instead of crashing. This was observed through `H5Gget_info()`. ++ ++ Fixes GitHub issue #6403 ++ + ## Java Library + + ### Renamed the Callbacks.java file to H5Callbacks.java +diff --git a/src/H5B.c b/src/H5B.c +index c9571708b73..4c6b1a55480 100644 +--- a/src/H5B.c ++++ b/src/H5B.c +@@ -1140,6 +1140,20 @@ H5B__iterate_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, int exp_lev + if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG))) + HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, H5_ITER_ERROR, "unable to load B-tree node"); + ++ /* Check for a corrupted B-tree node. If the caller has told us what ++ * level to expect, verify that the node we just protected actually has ++ * that level. This check must be performed here rather than relying ++ * solely on the equivalent check in H5B__cache_deserialize, because ++ * that deserialize callback only runs when a node is first loaded into ++ * the metadata cache. A corrupted B-tree whose child pointer revisits ++ * a node that is already cached (e.g. a node that points to itself) ++ * bypasses the deserialize callback entirely, so without this check the ++ * recursion below would never terminate and would overflow the stack. ++ */ ++ if (exp_level != H5B_UNKNOWN_NODELEVEL && bt->level != (unsigned)exp_level) ++ HGOTO_ERROR(H5E_BTREE, H5E_BADVALUE, H5_ITER_ERROR, ++ "B-tree node level is not as expected, possibly corrupted"); ++ + /* Iterate over node's children */ + for (u = 0; u < bt->nchildren && ret_value == H5_ITER_CONT; u++) { + if (bt->level > 0) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index b8e5101e41..99f1eebec2 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -24,6 +24,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-19025.patch \ file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ file://CVE-2026-19023-CVE-2026-19024.patch \ + file://CVE-2026-120689.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 20:05:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103164 Received: from mail-dl1-f41.google.com (mail-dl1-f41.google.com [74.125.82.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5195.1793909165956595850 for ; Thu, 05 Nov 2026 12:06:05 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=duNMQDCB; spf=pass (domain: gmail.com, ip: 74.125.82.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f41.google.com with SMTP id a92af1059eb24-15ea896ddc8so3844209c88.0 for ; Thu, 05 Nov 2026 12:06:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909165; x=1794513965; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KwtFoBITU/JKMonlRrIpVl62fbQbxwxQYJqmj8op4qw=; b=duNMQDCBzQg9sYIowJ6ngyr0q5DQF/Kp4JiyTgdLLiTnn9T0d1ne34NEHgBaC8VNWx 5Eo4trlXeDTnpSrdtHbjR5x4o8b8VRDqZ2rsKy8e52gegWgNr1xAfolRHpNiZBEK8jW2 JNW/B8ovPTV5cbKrfmS9UKd/ZnVVMGu7VSCBz0kuN55RRwvw41C/gdlpFXh1XBCeprY5 bTIzdAOe8CP3EysMa5OT4OC9SEAeWoDT9gohxi0KUPZFrZGqjopK8FntXyweEmwYBBVI aH1h5NMCPu3HnLn5SVSJJI2plwaWPduN8Ya6J/xFIeXO68SF8fKE4rAE81M0OBw4EzV+ on8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909165; x=1794513965; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=KwtFoBITU/JKMonlRrIpVl62fbQbxwxQYJqmj8op4qw=; b=hOv3TPpXr0f2hpxvoGGmxgPIk7Ji/vR68pd1j7SG6Cd9P+YvlbvahdpQj4xra0IIv1 PtlqirOVCQg/IxR1ksDNnFfRdTNECuQqhvOe27TVxBYMAzg9NLMUJX1/Mr7mhkoAKzjZ STBBzu1RuuNMeToDRYFXk1UjiibKPJW4vr0N7BPaqvew0KNx3/vcoI7xmj5zjvl+mgEj XcUCpbunSO4sZ518soXgYkeQvAomhNGLjAUCr5dexL9L7M9R2AoOsonmYoESjpKRokIz v1mrjHQem8eEhiLiUgt9V0xy+/IqOlEeyPCvbzcekhQ76HwrW1JbCdRk0MAjeQnI/dNd J/Og== X-Gm-Message-State: APuU4Z+Ihj9OGcl6TvUMhWzUE0HQyIkO5zmz4lhhGxUQ2QzyWoKckssl XWIfKluxK4zvRty16F4OIrSFVVbLFUwtbSlxbQeyMDLIiSdo8hMGu6qlS9urNw== X-Gm-Gg: AYBFou2NeqDiQwODJa8qoiBC/UABn4BzFpZBslCIxyP3R2+eBiwX2mWNQCz5pe62Q7C k7hwdv/Veipkl+fuCCqRJIq146jCU2reO9/V4BwTmL1n+AjADJnsG6PeWXAfjUowR9fmUladtTd yH29/B6jIfhDZ1598LAiArrsZvu9I0Ph9zzeVgBVDQH4XfMKw6kbRvEatX7LLd6VKq24wzwUoT9 J7IB4Q56secVZX1VFsbJmfs6ME7N4/J5P02xnqh24feu/ZNl376BfZmsDKoDpPJ1N1POt8e7wLm riBBy7aXE2As5BmzwpnbXiz64BR6oL/7vSAHe3/DWBvTlMNeDEZSiPFC7NTo661XDyY1pPQ/jcu axpDuMIF3Aq9t5xsaqExeXT4nOqODHyc8hJUTIlU2qazBrrBTbI4NV1jIfbI7GOdQqnNf1tzGgX RIkEnHAU3SgnywPqaWFDDqkyFa2vOQ4cMHm+2XAKUdeB8YNNlJc7r4lygF0oQHM1AKpDufBet3D 1aabo90F3xWqrGw3nMTqCK7+KHn73uoacnEi3a+QMVUGgbvdHkEoZP2V1tRi3G68MjlglZ9FCSy zaDca8qKdXTiX3WfSNRcC0OK7RcvYS13xxTCcptUjROzV4jhUnF6cTfzitMIcw== X-Received: by 2002:a05:701b:204f:20b0:19a:20d3:a3d6 with SMTP id a92af1059eb24-1b25d288481mr106648c88.1.1793909165101; Thu, 05 Nov 2026 12:06:05 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.06.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:06:04 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 4/9] hdf5: patch CVE-2026-120754 and CVE-2026-120755 Date: Fri, 6 Nov 2026 09:05:47 +1300 Message-ID: <20261105200552.81303-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105200552.81303-1-ankur.tyagi85@gmail.com> References: <20261105200552.81303-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131932 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120754 https://nvd.nist.gov/vuln/detail/cve-2026-120755 Signed-off-by: Ankur Tyagi --- .../CVE-2026-120754-CVE-2026-120755.patch | 172 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 173 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch new file mode 100644 index 0000000000..3f0a8d69d5 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch @@ -0,0 +1,172 @@ +From 78672660618de8cca7c804f465886af02a89e79b Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Wed, 21 Oct 2026 13:52:39 -0500 +Subject: [PATCH] Bound filter header reads to the stored chunk length (#6585) + +* bound scaleoffset and fletcher32 reads to the chunk buffer + +* Bound filter header reads to the stored chunk length + +This PR is an expansion of #6579. + +The scaleoffset bounds checks measured against *buf_size, the size of the +chunk buffer, rather than nbytes, the number of bytes the pipeline read from +the file. H5D__chunk_lock() sizes a filtered chunk buffer to MAX(stored size, +unfiltered size) so filters have room to expand into, and fills only the +stored bytes, so the buffer is routinely longer than the data in it. A +truncated chunk therefore passed the header check and decompressed out of the +uninitialized remainder of the allocation, returning unrelated heap contents +as dataset data. Because the reads stay inside the allocation, the address +sanitizer does not see them. + +This PR switches every read-side check in H5Z__filter_scaleoffset() +to bound against nbytes and pass the stored length to +H5Z__scaleoffset_decompress(). + +Similar short-chunk checks are added to szip and fletcher32. + +The direct chunk test has been extended to cover a chunk whose unfiltered size is +larger than the bytes stored for it, and to cover szip. + +* Correct potential invalid pointer usage + +* update CHANGELOG + +* Update CHANGELOG comment + +* Guard scaleoffset output size against multiplication overflow + +--------- + +Co-authored-by: Nayyar +Co-authored-by: Larry Knox + +CVE: CVE-2026-120754 CVE-2026-120755 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/cdb13c4de9c7edbbae180f384e2e610a3b3cf185] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Zfletcher32.c | 13 +++++++------ + src/H5Zscaleoffset.c | 15 +++++++++++---- + src/H5Zszip.c | 18 ++++++++++++++---- + 3 files changed, 32 insertions(+), 14 deletions(-) + +diff --git a/src/H5Zfletcher32.c b/src/H5Zfletcher32.c +index b89724ad0a3..5ef3b04cbcf 100644 +--- a/src/H5Zfletcher32.c ++++ b/src/H5Zfletcher32.c +@@ -62,13 +62,14 @@ H5Z__filter_fletcher32(unsigned flags, size_t H5_ATTR_UNUSED cd_nelmts, + assert(sizeof(uint32_t) >= 4); + + if (flags & H5Z_FLAG_REVERSE) { /* Read */ +- /* A Fletcher32-filtered buffer must contain at least the trailing +- * checksum. Reject anything smaller to avoid a size_t underflow +- * when computing the data length. ++ /* The checksum is stored at the end of the chunk, so anything shorter ++ * than the checksum itself makes the length arithmetic below wrap. A ++ * chunk of exactly FLETCHER_LEN bytes holds no data and would return a ++ * filtered size of zero, which the pipeline reports as a filter failure, ++ * so reject it here where the reason can be stated. + */ +- if (nbytes < FLETCHER_LEN) +- HGOTO_ERROR(H5E_STORAGE, H5E_OVERFLOW, 0, +- "fletcher32 filter input buffer too small to contain checksum"); ++ if (nbytes <= FLETCHER_LEN) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + + /* Do checksum if it's enabled for read; otherwise skip it + * to save performance. */ +diff --git a/src/H5Zscaleoffset.c b/src/H5Zscaleoffset.c +index d39b4f40403..d506e5203a0 100644 +--- a/src/H5Zscaleoffset.c ++++ b/src/H5Zscaleoffset.c +@@ -1205,10 +1205,18 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu + unsigned long long minval_mask = 0; + unsigned minval_size = 0; + +- minbits = 0; +- if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5, (unsigned char *)*buf + *buf_size - 1)) ++ /* Bound every read below by nbytes rather than *buf_size. The caller may ++ * provide a buffer larger than the data it holds, so restrict the read ++ * to the valid nbytes. ++ */ ++ /* The minbits and minval-size fields are the first five bytes of the ++ * stream, so validate that length before deriving an end-of-buffer ++ * pointer from nbytes ++ */ ++ if (nbytes < 5) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + ++ minbits = 0; + for (i = 0; i < 4; i++) { + minbits_mask = ((unsigned char *)*buf)[i]; + minbits_mask <<= i * 8; +@@ -1224,8 +1232,7 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu + minval_size = sizeof(unsigned long long) <= ((unsigned char *)*buf)[4] ? sizeof(unsigned long long) + : ((unsigned char *)*buf)[4]; + minval = 0; +- if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size, +- (unsigned char *)*buf + *buf_size - 1)) ++ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size, (unsigned char *)*buf + nbytes - 1)) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + for (i = 0; i < minval_size; i++) { + minval_mask = ((unsigned char *)*buf)[5 + i]; +diff --git a/src/H5Zszip.c b/src/H5Zszip.c +index 9b37035374f..dd6c3619873 100644 +--- a/src/H5Zszip.c ++++ b/src/H5Zszip.c +@@ -28,6 +28,9 @@ + #include "szlib.h" + #endif + ++/* Size of the uncompressed-length header stored in front of the szip stream */ ++#define SZIP_HEADER_LEN 4 ++ + /* Local function prototypes */ + static htri_t H5Z__can_apply_szip(hid_t dcpl_id, hid_t type_id, hid_t space_id); + static herr_t H5Z__set_local_szip(hid_t dcpl_id, hid_t type_id, hid_t space_id); +@@ -284,6 +287,13 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + uint32_t stored_nalloc; /* Number of bytes the compressed block will expand into */ + size_t nalloc; /* Number of bytes the compressed block will expand into */ + ++ /* The uncompressed length is stored in front of the compressed stream, so ++ * a chunk shorter than that header makes the length arithmetic below wrap. ++ * A chunk of exactly SZIP_HEADER_LEN bytes holds no compressed data. ++ */ ++ if (nbytes <= SZIP_HEADER_LEN) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); ++ + /* Get the size of the uncompressed buffer */ + newbuf = (unsigned char *)(*buf); + UINT32DECODE(newbuf, stored_nalloc); +@@ -295,7 +305,7 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + + /* Decompress the buffer */ + size_out = nalloc; +- if (SZ_BufftoBuffDecompress(outbuf, &size_out, newbuf, nbytes - 4, &sz_param) != SZ_OK) ++ if (SZ_BufftoBuffDecompress(outbuf, &size_out, newbuf, nbytes - SZIP_HEADER_LEN, &sz_param) != SZ_OK) + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "szip_filter: decompression failed"); + assert(size_out == nalloc); + +@@ -313,7 +323,7 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + unsigned char *dst = NULL; /* Temporary pointer to new output buffer */ + + /* Allocate space for the compressed buffer & header (assume data won't get bigger) */ +- if (NULL == (dst = outbuf = (unsigned char *)H5MM_malloc(nbytes + 4))) ++ if (NULL == (dst = outbuf = (unsigned char *)H5MM_malloc(nbytes + SZIP_HEADER_LEN))) + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "unable to allocate szip destination buffer"); + + /* Encode the uncompressed length */ +@@ -332,8 +342,8 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + /* Set return values */ + *buf = outbuf; + outbuf = NULL; +- *buf_size = nbytes + 4; +- ret_value = size_out + 4; ++ *buf_size = nbytes + SZIP_HEADER_LEN; ++ ret_value = size_out + SZIP_HEADER_LEN; + } + + done: diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 99f1eebec2..7642beb675 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -25,6 +25,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ file://CVE-2026-19023-CVE-2026-19024.patch \ file://CVE-2026-120689.patch \ + file://CVE-2026-120754-CVE-2026-120755.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 20:05:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103172 Received: from mail-dl1-f50.google.com (mail-dl1-f50.google.com [74.125.82.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5091.1793909167897505969 for ; Thu, 05 Nov 2026 12:06:07 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=UGAwadAw; spf=pass (domain: gmail.com, ip: 74.125.82.50, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f50.google.com with SMTP id a92af1059eb24-1a3c08d6928so3504319c88.0 for ; Thu, 05 Nov 2026 12:06:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909167; x=1794513967; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fdZ5Po0dH9j4Xncp7g8j7RBPkW4chm+yQm+3V2nprJY=; b=UGAwadAwqFocqd7PiXzurf4uAkIJD1NymgNFeuiJVYl8r+KQfrbewcT1dAtjKTmIwa Yec+F1dUnZ0oBGkt2etXLdqUaZ1fQfa4aQ2YQ8E1bQZrAqvc/fHXPjum2AdCgyKa5aB/ Ai1bqvjUBK4un+4UvBNIeUHLZv8FcXQU/fSk9RcZy1/0/qlaYCyfaMy0efgXhba/UHCy n0Y3QOjggLkhSGNANVdHQF33TnzauGRlxtXvECXQQWIGHlGV+2X3NA5qtk1Nnsdk1RQv iNSwZCoD64mmcDRzdFnD/NTYff+XPzTYbWmo0PjENVCfmZZACa0EJjwdUmVAktHVPj3S BfCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909167; x=1794513967; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=fdZ5Po0dH9j4Xncp7g8j7RBPkW4chm+yQm+3V2nprJY=; b=SQuXskqJjM+eHINEweFOInLJ34mTpnsVJ5FI82vBbyuQe/OCAQmR2ljWuZ2HhFPuuc B89mkoKFcZCjmRl43Hh8ojEESrL/KiBK5vpUJiVdT7xs2wCdj9SUvfFHj3Hyt4eThSj1 1UzdWXSKrXEeUok/XiIYxuJje2itJLHKpGr9bEaYn9Iv0Qn87zHu2UYujUgZ/0snm+LB qZUazFSPwFBqg+6P7hT/SnUX+d+NUP5uku1yRbg0vVQwdWk8fffAkUzwx4i3xa0OzVn3 pboghycHNBXDxNkMkqBt6BV71zXQfMmgcosktOne6+DCuwzy8QETqgL1bH/BnlCY7ojr BNHA== X-Gm-Message-State: APuU4Z8DsKC37qgwVW7IjtnKiwiNBfjKbA9DbHDw7darNraC2aWGzdEi u1CBXwYMeakrir7YOiocd3Ewz4uVN9DoCy7l6AK7HSuQGGZpFB8oc2snFClbZQ== X-Gm-Gg: AYBFou1n143RULGsXs/6C+lXgvplAEvGtISQnOl95e3orMXCM9Rhf2UUphw0oLhb6BN xY4y1cUyGn834iBqNr+jvp1Htats8+pr4ifBA7in6HR9lFKn0axRIQ7odg44ES7Hp2QHkivwAoR zjQgA45pPgWJ1xrAvMci3uFi3ybuZOYYohAQdSiVdJQI0G60U7HJSzFUXxlqkKBtEaf50cRln4O bN4CbjSRxm4n7Alvbx5/g+iJywAmNQgygynvqnIQVqft9891sRCkv5V/SzDBoQtKHGKPsOse4OU INZgioSwOo1yFG3JMB1NhUPkCjeqiySP78tTdqarIKChVsRUfgICKGpRRxuc1Y0OwuI3M7TTDT0 G2WUTzohY6W9c22hCFC0gwfLitC2XvyUEEWEOOCe1UQJUUBG5/V//OTDr4ZSuSMoyB68BosirhI Ng5QgkZyY8RioDRRPMS8WOxp2kiqO/4m+VbDKBXmYFzxf1jGc1wcXW1jlOH+1BMrCMGqFCC0B9U NJZqJKo2ZZI39k+DHVjcIbs8/CCwA6HXofc289qGjkrjMf4TbeAmuJmhGc8ixgZz8OqjTiG5Ua8 rUxW+rmXeleljhtnaXdFcoPZdcWlZOdhDnYyST+e5UYPwnHd3NaeZMRWyWIkKg== X-Received: by 2002:a05:701b:4515:20b0:1b2:3448:840f with SMTP id a92af1059eb24-1b25d31edc9mr73787c88.7.1793909167077; Thu, 05 Nov 2026 12:06:07 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.06.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:06:06 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 5/9] hdf5: patch CVE-2026-120756 Date: Fri, 6 Nov 2026 09:05:48 +1300 Message-ID: <20261105200552.81303-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105200552.81303-1-ankur.tyagi85@gmail.com> References: <20261105200552.81303-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131933 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120756 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-120756.patch | 45 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch new file mode 100644 index 0000000000..28bd658598 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch @@ -0,0 +1,45 @@ +From 43855883c1ea10a072b7e7cf2dbc5a29ab411a8f Mon Sep 17 00:00:00 2001 +From: Nayyar +Date: Sat, 12 Sep 2026 16:37:49 +0530 +Subject: [PATCH] check object header message size after decoding its header + (#6589) + +(cherry picked from commit 10f1af5528168c5a71a58eba0b486e0677f3aaa3) + +CVE: CVE-2026-120756 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/10f1af5528168c5a71a58eba0b486e0677f3aaa3] + +Dropped changes to the test and CHANGELOG file. +Signed-off-by: Ankur Tyagi +--- + src/H5Ocache.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/src/H5Ocache.c b/src/H5Ocache.c +index 8f0928f290e..9dc6a2e21bb 100644 +--- a/src/H5Ocache.c ++++ b/src/H5Ocache.c +@@ -1270,9 +1270,6 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t + if (mesg_size != H5O_ALIGN_OH(oh, mesg_size)) + HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL, "message not aligned"); + +- if (H5_IS_BUFFER_OVERFLOW(chunk_image, mesg_size, p_end)) +- HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, FAIL, "message size exceeds buffer end"); +- + /* Message flags */ + if (H5_IS_BUFFER_OVERFLOW(chunk_image, 1, p_end)) + HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, FAIL, "ran off end of input buffer while decoding"); +@@ -1305,6 +1302,13 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t + } + } + ++ /* The message body starts after the message header, so its size can ++ * only be checked against the buffer once the whole header has been ++ * decoded ++ */ ++ if (H5_IS_BUFFER_OVERFLOW(chunk_image, mesg_size, p_end)) ++ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, FAIL, "message size exceeds buffer end"); ++ + /* Increment count of null messages */ + if (H5O_NULL_ID == id) + nullcnt++; diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 7642beb675..7afba18084 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -26,6 +26,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-19023-CVE-2026-19024.patch \ file://CVE-2026-120689.patch \ file://CVE-2026-120754-CVE-2026-120755.patch \ + file://CVE-2026-120756.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 20:05:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103167 Received: from mail-dl1-f47.google.com (mail-dl1-f47.google.com [74.125.82.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5197.1793909169981804168 for ; Thu, 05 Nov 2026 12:06:10 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=jIGGHUa7; spf=pass (domain: gmail.com, ip: 74.125.82.47, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f47.google.com with SMTP id a92af1059eb24-1adbf62dd31so3095770c88.0 for ; Thu, 05 Nov 2026 12:06:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909169; x=1794513969; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OLyO4K4cO4WIExw6NDm1jqbfy6Qfj5uFqYtxy1/CseE=; b=jIGGHUa7fSTDDw39SS8ebpl07cO+96V+lJDIayl+j3s+OTix0h6kESn9O7gtJXlFKR MnPxZgO5f95eHnYQstb5It9psvJEzT4BXtzLZluvcm/ZgCL791dMXRPDf6vXdP+qK/uz hz0Z7te7FsAWM+HNYz0vw1n4GQiJ1hns0/cjRF3VOpxRTRgB9lLiIhpJYM6jmZXD0147 q1Lp5JKSq5GVYFK/rh0TiIaCGtX1rg6QLj5rC/U1XM3bgf6ey8HsEs3LZ0JQ/dYMn05d eS2KpxCXkeuuTxOhlNqPIrg2KF1eWTtpEo1PR1tqVOJfvU5MLN7NLfxrMvqZQSA7XmPB SSOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909169; x=1794513969; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=OLyO4K4cO4WIExw6NDm1jqbfy6Qfj5uFqYtxy1/CseE=; b=FDx5KxJ7tuAYHyFe1pwTYBCYjJpF9pwprbJ8aakskFmr9is0AQnEB9Y3s++7gka6e5 ytRnRhZ2DscWyWXBa4wuJ9T7RZhgAQzp+BYc8CwPsx5t2xwqaKwMzo2OjL9jxJZM3Ub1 aqQVY//3NBNHCWUeKRuVFUcTfuFa7kGVDmoNMthYl8TZLxseXiTUfkiJukRgnfL+vdFO e3+gLxahmjeSVMYcZykViD/aJvfSbNiA29Hpu7P+6GpRIReW89x84wAEacLtIX+14MmD QyBEaHgZbbVwG3cfUw23xMOwoALtmGhE+VgII9A0IlHzUqxSVgg+lWEfBivLVfgkS5ue AYlw== X-Gm-Message-State: APuU4Z+oDOF6ncd/cH+lD3tPYEkqy8HDnb78ksvXjCBDLW8potq5VAHY hW+7MME96PJ4LyAZmq4U8uBrc+dfZqMvWaqnKGnWPASqy4rDrMc09tWuFaJVwA== X-Gm-Gg: AYBFou2YA236akgWG9LQn5GZYvM2I9sXdE2BYGTZ5hoRbe1pkrzr94gAhWFHqmjErt+ FFjeHT86TK3Fv2w+ttyIe0B1wh+s0YDfRz6ldF9/1Xubf+nZzi+Gj2KxDN3AbK+ZiWqfi9nzfBh 7X17ub/pTPEZuptfy5doBdhTOcFutHYouyxxsTaLPYyxkBA8gqYEz+9jSuXN4at5L/OT6FSB61t EZhvW7GTVkZISqels9xqpkyxkwEaIkCQnPe+k+UvK33lT7noohozJKWcVQJKcK0l81AjOHXqp20 lnYhiJRyF5zbfHKCt8heZsqFcdSSHEmlzp3/VTdmjpXpBz19kMAYME1zz4u8t99roZd0UiV27bR nlwcqWuQclskukCXfNDaLp9nvDI0IPwh7XbRQybkaEaY0piZqwjBfJ08eoh2DjhQGua8mcHL99p Lc7viATJFDsK+mTQzU9muYX7AIyo1FmYtYWpYrLdK6+TGH82SKmbAO5KRwnrOGtlw9xpvVP4pdG HF77JZSUZ4ZqD1Gfic5hegBcxi0Cd/6oyiFFAxlSa6QFx4+RO0fRPa8FynbSfltu+p8Zmzq4NdL JtyGpopM5/AXlcLKgdSO7QmaPJQ8TUpJJD1X0V1rUoYx2exOKhgC5EEIUTmYZCsY X-Received: by 2002:a05:7023:90b:b0:195:866:aff1 with SMTP id a92af1059eb24-1b25d34a822mr74521c88.25.1793909169143; Thu, 05 Nov 2026 12:06:09 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.06.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:06:08 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 6/9] hdf5: patch CVE-2026-120757 Date: Fri, 6 Nov 2026 09:05:49 +1300 Message-ID: <20261105200552.81303-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105200552.81303-1-ankur.tyagi85@gmail.com> References: <20261105200552.81303-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131934 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120757 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-120757.patch | 63 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 64 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch new file mode 100644 index 0000000000..886d6d946b --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch @@ -0,0 +1,63 @@ +From fa4c737d41c1c86638525a290b5576c8966090d0 Mon Sep 17 00:00:00 2001 +From: Nayyar +Date: Thu, 8 Oct 2026 18:57:14 +0530 +Subject: [PATCH] reject malformed external link data in H5L__extern_traverse + (#6708) + +* validate external link data before parsing in traversal + +(cherry picked from commit 8117f4c75fdfb5e759ad73ce62d7ef4584130acd) + +CVE: CVE-2026-120757 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/8117f4c75fdfb5e759ad73ce62d7ef4584130acd] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Lexternal.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/src/H5Lexternal.c b/src/H5Lexternal.c +index 793825d1c3d..5f874d53177 100644 +--- a/src/H5Lexternal.c ++++ b/src/H5Lexternal.c +@@ -93,7 +93,7 @@ static const H5L_class_t H5L_EXTERN_LINK_CLASS[1] = {{ + */ + static hid_t + H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, const void *_udata, +- size_t H5_ATTR_UNUSED udata_size, hid_t lapl_id, hid_t H5_ATTR_UNUSED dxpl_id) ++ size_t udata_size, hid_t lapl_id, hid_t H5_ATTR_UNUSED dxpl_id) + { + H5P_genplist_t *plist; /* Property list pointer */ + H5G_loc_t root_loc; /* Location of root group in external file */ +@@ -121,6 +121,18 @@ H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, cons + /* Sanity checks */ + assert(p); + ++ /* The udata holds a version/flags byte followed by two NULL-terminated ++ * strings (file name and object path). The strings are located below with ++ * strlen(), so validate the buffer against udata_size first: it must have ++ * room for both strings and end on a NULL terminator. A malformed link ++ * from a corrupted file would otherwise read past the udata buffer. This ++ * matches the checks in H5Lunpack_elink_val(). ++ */ ++ if (udata_size <= 2) ++ HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data too small"); ++ if (p[udata_size - 1] != '\0') ++ HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data is not NULL-terminated"); ++ + /* Check external link version & flags */ + if (((*p >> 4) & 0x0F) > H5L_EXT_VERSION) + HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "bad version number for external link"); +@@ -131,7 +143,9 @@ H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, cons + /* Gather some information from the external link's user data */ + file_name = (const char *)p; + fname_len = strlen(file_name); +- obj_name = (const char *)p + fname_len + 1; ++ if ((fname_len + 1) >= (udata_size - 1)) ++ HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data has no object path"); ++ obj_name = (const char *)p + fname_len + 1; + + /* Get the plist structure */ + if (NULL == (plist = H5P_object_verify(lapl_id, H5P_LINK_ACCESS, true))) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 7afba18084..3e978a75ac 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -27,6 +27,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-120689.patch \ file://CVE-2026-120754-CVE-2026-120755.patch \ file://CVE-2026-120756.patch \ + file://CVE-2026-120757.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 20:05:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103168 Received: from mail-dl1-f44.google.com (mail-dl1-f44.google.com [74.125.82.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5200.1793909172296703250 for ; Thu, 05 Nov 2026 12:06:12 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=oMH2kxbT; spf=pass (domain: gmail.com, ip: 74.125.82.44, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f44.google.com with SMTP id a92af1059eb24-19305bcb72cso2126446c88.1 for ; Thu, 05 Nov 2026 12:06:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909172; x=1794513972; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OMLdY1ot2D1XA3QD71W6Vugv3KASgMf0R7rS+KI97Gg=; b=oMH2kxbTRocObnKAuHGpwcZmnlgO7wng4iS1myvAiOAzQW9YSIPJByv+17t7YBWMi9 lZ5S7fFv6r/vcQUkTYor4nRoJuas2KEGTpsbebLrDXZ6oal0/Vxo5X/tJkZrW1VQU+sM zgd+HVWT5pdq7qfjG0wOjXENWneo9VoBiYOyILuVd5d1TqH7L2VngXGKDUnOxoRKuJpD TxyEYjLhByPm2lK78aKhmQkxSiUVEfMlc+tDTOBXpZtOl1qW9L9e+L6RYweEw0nYmRhk Lrk0+/Dtc0l3SOZQRPgJRNaofO+oxEK3Hl1bKW0Dbo6EsCD6r5TigtjPcBN29ISl3nG4 tKqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909172; x=1794513972; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=OMLdY1ot2D1XA3QD71W6Vugv3KASgMf0R7rS+KI97Gg=; b=pq9FB0kNmIciLMKYej1y6UKQ+Eenb/zg7vrrhjOcOIe0CM5s5CbwX5tTlXSYNfcnL3 847rXUaV4CwJzBlWFDdQbjVBQ2M1AOAPElKICTald4c2vLbtq6qNCzgcMHq6nxOFy2+0 qXmZW8NKJkXMwJ+S88ukXXuqW9DaT+ZkuHo47sOs8DszuKlksINyoPIj2+w50JXsnJxz 5EW9Vvwru6BjU5qsmGfS3RvvuzcNNnZWLM+fdQhls6uSELJ7K2wz8Z6MZcOQkZIUJVnx v55nwMRutfqmiezSzLlY9Rn1+b8c+lO9tlYZfh6zcJHq+BZO4AHzCMJSB9aE01kafgmi 8muw== X-Gm-Message-State: APuU4Z+Apqjal2V3WKhq6/DKLbddCreJioqaWwNxryr43LfwDL8nJB9A bWv6BDdx1Lp4BdWUbDOIXJLp39tkrSBDnhxDJweV5sFN7s3lkNV+ibkLjfyVmg== X-Gm-Gg: AYBFou2m5b8orGMMk/63ugQ146TjNK6/C24zPJmkCrKPiJZ4aEa8nTuVPJfp3rjFEyP 5ph5q3K+5exAEmBng7Dq9d/la8BqRM2CUgz9yXYZrv5xWi/gcgKJrVV5f1DWisV7Uj11c8AinV4 GaK93R4VAn5v2KRcabd7pL1Vq5qdiIy1BaItOclwrbJ+E1F7ScglfZufYZqEtYwJq1fgOpLpeGV IkxDyoS5uv7FQ4xqYnhfYn3/6fTocXXhubp26D6sJAyDiPXvmRR1NZfxxFTQ3ecsnVjdJtki3km W4z7AcnUF7MJg/aDzWlwSLQunrY5dy4PNa76lDSLiqwM5dASWJsYDPIMa1tQgyOko6t3afrfsv6 U6TQwZ8nqatqph6/DTGqyS27F0SRdffHuE+aOewpsNckyvM+54iMksfV/Qzf+a0N68NqEHe2oyB SYvjNLVSDb/UW/LDk1JRKiEadUmzkC52cERhByGWRLlOWrqHXjc7vaaJYY27IdHwLOt7RkCE+uN 7+zF3cdEoar7CbA0NVJpcXw5t2QS1Pm2N7YLBCtRV3B121E28e+msBSJoIdO21/7fWamP88/Agy sMW6Ng4zaf35ty27HpLBzy0+p5Fw7ltECoRqnoZ/Kx57W8GUc4c0+HOPcgw/zw== X-Received: by 2002:a05:7022:b056:10b0:167:4198:2cb3 with SMTP id a92af1059eb24-1b25d3083a7mr81485c88.18.1793909171216; Thu, 05 Nov 2026 12:06:11 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.06.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:06:10 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 7/9] hdf5: patch CVE-2026-120758 Date: Fri, 6 Nov 2026 09:05:50 +1300 Message-ID: <20261105200552.81303-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105200552.81303-1-ankur.tyagi85@gmail.com> References: <20261105200552.81303-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131935 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120758 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-120758.patch | 143 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 144 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120758.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120758.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120758.patch new file mode 100644 index 0000000000..a8fb5f72ff --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120758.patch @@ -0,0 +1,143 @@ +From 277a6bbfdb8e852b7bbd08ae002907fc559e0194 Mon Sep 17 00:00:00 2001 +From: tbeu +Date: Sat, 3 Oct 2026 07:43:53 +0200 +Subject: [PATCH] Fix NULL pointer dereferences in H5HL_protect and + H5HL_unprotect (#6377) + +* Fix NULL pointer dereferences in H5HL_protect and H5HL_unprotect + +When reading corrupted HDF5 files, H5HL_protect can encounter a heap +where prfx->heap is NULL or heap->dblk_image is NULL. Similarly, +H5HL_unprotect can encounter a heap where heap->prfx or heap->dblk has +been set to NULL by H5HL__prfx_dest during cache eviction of corrupted +entries. In both cases, the code proceeded to dereference NULL pointers, +causing a segfault (found by OSS-Fuzz via matio). + +Replace the assert in H5HL_unprotect with proper NULL checks and +HGOTO_ERROR, and add equivalent guards in H5HL_protect, so corrupted +files are rejected gracefully instead of crashing. + +* Address review: drop speculative H5HL_protect NULL checks, add regression test + changelog + +- Remove the NULL checks in H5HL_protect for prfx->heap and heap->dblk_image. + prfx->heap is set in H5HL__prfx_new and only cleared in H5HL__prfx_dest (which + frees the prefix in the same call), so the check is unreachable and could leak + prfx via the done block. heap->dblk_image is NULL by design whenever the data + block is not contiguous with the prefix, so that check was a false positive. +- Keep the H5HL_unprotect NULL checks for heap->prfx and heap->dblk, which are the + actual fix for the reported crash (OSS-Fuzz 504827191). +- Add a regression test (corrupt_heap_unprotect) in test/lheap.c using the + minimized fuzzer file heap_corrupt_prfx.h5, asserting the corrupted file fails + gracefully instead of crashing in H5HL_unprotect. +- Document the fix in release_docs/CHANGELOG.md. + +* Improve lheap regression test for H5HL_unprotect NULL deref + +Replace the file-based traversal (which does not deterministically reach +the cache-eviction path that nulls heap->prfx) with a white-box check that +protects a local heap, simulates the corrupted/evicted condition by nulling +the heap's prfx/dblk pointers, and verifies H5HL_unprotect() returns an +error instead of dereferencing NULL. Keep a best-effort open/traverse of the +OSS-Fuzz minimized file (issue 504827191) as a smoke test. + +Verified: without the fix the test aborts (H5AC_unpin_entry(NULL)); with the +fix it passes. + +* Improve lheap regression test to consider review comments + +* Fix formatting + +* test: improve lheap regression test for reviewer comments + +- Use H5L_info2_t in visitor (matches H5L_iterate2_t signature) +- Use H5O_info2_t with H5Oget_info_by_name3 +- Replicate matio's exact traversal: H5Literate2 + H5Gopen2/H5Dopen2 + + H5Lvisit2 recursion, H5Aiterate2 attribute reads, skip #refs#/#subsystem# +- Keep white-box deterministic NULL-pointer guard (fuzzer file does not + deterministically crash via public API alone; original crash required + matio fuzzer's specific cache-pressure environment) +- Add CORRUPT_HEAP_TESTFILE define back for white-box test + +* Fix formatting + +* Reject a local heap unprotect when its pinned cache entry is gone + +H5HL_unprotect() now reports an error instead of dereferencing NULL when the +cache entry that H5HL_protect() pinned is no longer linked to the heap, and it +checks for that before decrementing the protect count so a rejected call leaves +the heap unchanged. The regression test as written couldn't fail, since its cleanup +label was after passed and every failure path still returned 0 (success). +It also only ever built single-cache-object heaps, and didn't reach the branch the crash +came from. It now grows a heap into a separate data block to cover both +branches and uses the standard error reporting. + +--------- + +Co-authored-by: Matthew Larson +Co-authored-by: Matt L <124107509+mattjala@users.noreply.github.com> +Co-authored-by: Larry Knox + +CVE: CVE-2026-120758 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/91fc37c3325264e67699408e3a190fe4f329bf85] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5HL.c | 34 +++++++++++++++++++++------------- + 1 file changed, 21 insertions(+), 13 deletions(-) + +diff --git a/src/H5HL.c b/src/H5HL.c +index b55b3690617..838426406a9 100644 +--- a/src/H5HL.c ++++ b/src/H5HL.c +@@ -416,28 +416,36 @@ H5HL_unprotect(H5HL_t *heap) + /* Check arguments */ + assert(heap); + +- /* Decrement # of times heap is protected */ +- heap->prots--; +- + /* Check for last unprotection of heap */ +- if (heap->prots == 0) { +- /* Check for separate heap data block */ ++ if (heap->prots == 1) { ++ void *pin_obj; /* Pointer to local heap object to unpin */ ++ ++ /* Get the object that H5HL_protect() pinned. It is unlinked from the ++ * heap when the cache destroys it, which a damaged file can provoke, ++ * so check for it before the protect count is decremented. ++ */ + if (heap->single_cache_obj) { +- /* Mark local heap prefix as evictable again */ +- if (FAIL == H5AC_unpin_entry(heap->prfx)) +- HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "unable to unpin local heap data block"); ++ if (NULL == heap->prfx) ++ HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "local heap prefix is not in the cache"); ++ ++ pin_obj = heap->prfx; + } + else { +- /* Sanity check */ +- assert(heap->dblk); ++ if (NULL == heap->dblk) ++ HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "local heap data block is not in the cache"); + +- /* Mark local heap data block as evictable again */ + /* (data block still pins prefix) */ +- if (FAIL == H5AC_unpin_entry(heap->dblk)) +- HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "unable to unpin local heap data block"); ++ pin_obj = heap->dblk; + } ++ ++ /* Mark local heap object as evictable again */ ++ if (FAIL == H5AC_unpin_entry(pin_obj)) ++ HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "unable to unpin local heap object"); + } + ++ /* Decrement # of times heap is protected */ ++ heap->prots--; ++ + done: + FUNC_LEAVE_NOAPI(ret_value) + } /* end H5HL_unprotect() */ diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 3e978a75ac..1520f8cab8 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -28,6 +28,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-120754-CVE-2026-120755.patch \ file://CVE-2026-120756.patch \ file://CVE-2026-120757.patch \ + file://CVE-2026-120758.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 20:05:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103169 Received: from mail-dl1-f51.google.com (mail-dl1-f51.google.com [74.125.82.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5093.1793909173997087841 for ; Thu, 05 Nov 2026 12:06:14 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Utdhm5Bh; spf=pass (domain: gmail.com, ip: 74.125.82.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f51.google.com with SMTP id a92af1059eb24-170135e43c7so33302c88.0 for ; Thu, 05 Nov 2026 12:06:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909173; x=1794513973; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AzK/GcssTXrpUDQaCDfhx0bFanW0XUz8u95RSnWXkYE=; b=Utdhm5BhMkF5t9BbxpNP3QaJnTVxP1H1qCGKA7SEZyXXys9aimaONVda7CfjBf29z8 cwiexuaDtswNtXEFj1Io+ZI8OZ3EQqT5xmIS90IH8k2ZJxq8/UFiirObFcdhyygs7/01 qMwjSmieVCbeoc34KuAHe0nookc897NFX3v9+ppINWowM2dguupdjbxqF5GcWhtKLcM3 ZaSB5AatAfilAr4emKmrKOfbVWYHa7HzhHNP+elQE2GnohHhr1K2q1pY2IGVR7fsu0Sy 5UQGHKHhmulZNAoUsNF/aRXevqUfGX1IAVcQKvjENpC0W1FomswQYE+OKq1atsE37cfV CWsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909173; x=1794513973; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=AzK/GcssTXrpUDQaCDfhx0bFanW0XUz8u95RSnWXkYE=; b=UtbA1TbVJWdp22w18Vc0vmWU1HyX1RcISR5WduxmfhmFYdoCSuYA1DiQczHQHpZnj/ Md4x/wAqqRu/qrIsfj9jOvdr6a9hqTman6SZ0zp3Wi1CyizeZER9QkGE5YsN/74ggN7m QmhUJIh52ac+PASBKGgWYFuIymuinXSIKEZAXLN65+woIv9hrF4HqduAx1VFDC+GzV93 833ts/3PA2KjXb2ScS9dwyDa3GFOLZR7KVAEUJY8YbUc02XpPdCJa/8TfzX7f+prlG4n qLsl6Ea4KW5Zubrvn+bww7qQ2mm/QrO319pQbSTFJYtW4a+IG83R3PxjHMvLmfZ6d391 Z8jA== X-Gm-Message-State: APuU4Z/Jo7YH0hRzEpROLuupwFyJJjDSj2AE9ZcsxBvShob8U2lc6/NC zk9zz6fw7XmU/7sZ8/nUNEPHLBw1/6dzxTR0oCGSmvufVM473mcAU3vHlVLuPg== X-Gm-Gg: AYBFou1J5LJMnp6yYRmnX1NQeoU4HU0R32kRfMUbev2saHK5lASQ0QmCKbRPewLXtQm gassqf0aYTyauNuIgpByjWeaaX05VZbegNbUoWzL78zm+3DgEuZ9FfKSNMOAUj1iagkwLvg7i32 7aiimaevyAcfb06hg4dfhZ9bIGBkitXfyA3rA30e13ItH3KR/huA4oqKBjFMeD19/28EZdrRjWE sguUn63aaPqkVdoHnrhq3q0Gl8cX9wL3Uq8sYOnVQbtHW0kokAgZ8xeksxTiH360hGJMDRYdBBJ W70K+hE6tZlbe2sfp4DxH5gAkCfI62VFpZ+6PCdaxw30Gp/RTHKR6EkTlv6acCUaBvvTwPbfwZW 2/22A5cjwdSWNSDhhxHHEotm0exCb+tdxj6S4OrRXEvJ/z+JYolPk2s8AiSgrqX4j5+X4sYvf21 5aTzx/BdkuT0kYKdaa1LPY4OIfiesQVn+xaPCqyDDAW59Ak13YnOjkZ3SzOOAy3ts6nHh+i3oo6 OYO/68vH8Y/Iby/uzfbaoo/+tv5exkC7cP3fS3vmffBghR9DQqRvOMqZRCs1pw4PK67DVgPzwn7 RT6N9feAjkIXTjiRDynQJnTT2dVg2zn7C+lBUZq6P7VXUVeeTcHeFfrH5Xe/gQ== X-Received: by 2002:a05:701b:42d0:20b0:190:b2de:1549 with SMTP id a92af1059eb24-1b25d294017mr109945c88.1.1793909173255; Thu, 05 Nov 2026 12:06:13 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.06.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:06:12 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 8/9] libgphoto2: patch CVE-2026-120451 Date: Fri, 6 Nov 2026 09:05:51 +1300 Message-ID: <20261105200552.81303-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105200552.81303-1-ankur.tyagi85@gmail.com> References: <20261105200552.81303-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131936 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120451 Signed-off-by: Ankur Tyagi --- .../gphoto2/libgphoto2/CVE-2026-120451.patch | 43 +++++++++++++++++++ .../gphoto2/libgphoto2_2.5.34.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch new file mode 100644 index 0000000000..7addb4d566 --- /dev/null +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch @@ -0,0 +1,43 @@ +From 5924549b4750f0b17369f82e98959b779880400a Mon Sep 17 00:00:00 2001 +From: TheProtagonist07 <63047129+TheProtagonist07@users.noreply.github.com> +Date: Wed, 28 Oct 2026 18:51:05 +0530 +Subject: [PATCH] jl2005c: reject an allocation table that does not fit the + buffers + +jl2005c_init() computes alloc_table_size from the entry count reported by +the camera and then reads that many bytes into the 0x4020 byte info[] stack +buffer and copies them into priv->table[0x4000]. For nb_entries >= 1022 both +operations write past the end of their destination. + +Return GP_ERROR_CORRUPTED_DATA if the table would not fit. + +Addresses findings 1 and 2 of #1326. + +(cherry picked from commit 6a3393dd996502457ab965432cf0b2035278825e) + +CVE: CVE-2026-120451 +Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/6a3393dd996502457ab965432cf0b2035278825e] +Signed-off-by: Ankur Tyagi +--- + camlibs/jl2005c/jl2005c.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/camlibs/jl2005c/jl2005c.c b/camlibs/jl2005c/jl2005c.c +index c447a2300..12c106acb 100644 +--- a/camlibs/jl2005c/jl2005c.c ++++ b/camlibs/jl2005c/jl2005c.c +@@ -144,6 +144,14 @@ restart: + alloc_table_size = priv->nb_entries * 0x10 + 0x30; + if (alloc_table_size%0x200) + alloc_table_size += 0x200 - (alloc_table_size%0x200); ++ /* nb_entries comes from the camera. The table has to fit into the ++ * local info buffer as well as into priv->table. */ ++ if ((size_t)alloc_table_size > sizeof(info) || ++ (size_t)alloc_table_size - 0x30 > sizeof(priv->table)) { ++ GP_DEBUG("alloc_table_size 0x%x is too large for %d entries\n", ++ alloc_table_size, priv->nb_entries); ++ return GP_ERROR_CORRUPTED_DATA; ++ } + /* However, we have already just now downloaded 0x200 bytes, so + * when downloading the rest of the table we correct for that and + * just download whatever remains of the information block. diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb index fca158fe11..488364b542 100644 --- a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb @@ -12,6 +12,7 @@ DEPENDS = "libtool jpeg virtual/libusb0 libexif zlib libxml2" SRC_URI = "${SOURCEFORGE_MIRROR}/gphoto/${BP}.tar.xz;name=libgphoto2 \ file://40-libgphoto2.rules \ file://0001-configure-Filter-out-buildpaths-from-CC.patch \ + file://CVE-2026-120451.patch \ " SRC_URI[libgphoto2.sha256sum] = "51993f5d9bfb6b4e5925cbbe5883085791bff6f81bcacb8ffe1b783ce76d586a" From patchwork Thu Nov 5 20:05:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103170 Received: from mail-dl1-f52.google.com (mail-dl1-f52.google.com [74.125.82.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5094.1793909176563863839 for ; Thu, 05 Nov 2026 12:06:16 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=DOx9g4Jp; spf=pass (domain: gmail.com, ip: 74.125.82.52, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f52.google.com with SMTP id a92af1059eb24-15ea896ddc8so3844520c88.0 for ; Thu, 05 Nov 2026 12:06:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793909176; x=1794513976; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EXDnuMmr3y9gcVgM0wnWPHDyc1JKSKw03AUnG1TJRpw=; b=DOx9g4JpMyGYN+e8LTD4VhoM5NcZyzBJiH6MB4t0+CgQUnSnxHB7Kw8BjySrFDYZVz 7GzS89FS68q3x2DbDqEeoO1eTMZx/0QXzh1v3Wv5f1vpmbL4caMLDbz1XNGhb/AuTHXp nWJqdrO9TR8mY/x4GR86vM9Yi59eO5peae2sM4CmOlCNJ2bapSjIC8r0neQDJdyFz5hL Cg7ej+jPUxGt4/3IeKfHlCzuNjMR8ETO0lYypk7ZOTRP6hlzaQMptV90JxV4a4H9K+B/ uHlz7jJgViUc99QGBJtFCFr8g5gjfxVpd7wGQHy8xiLOp7O2Q0/YhGcWvfZ9+6QcNRWI kZAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793909176; x=1794513976; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=EXDnuMmr3y9gcVgM0wnWPHDyc1JKSKw03AUnG1TJRpw=; b=ZMgmgT+Rv0882iwVz57UVy7Zd8olLFptXBSFcCklxw/DSteVzvAmtEBmn5D6B1IFyK C7zPfu06ZqlnWKQHs62bBdwhYYUfZz3GX1hxbG/oFFvsJuhdyOOgPTZPLGOY+uQfTO20 9s7+LhcIN1oenVvOMFrETVUp3C7LTdhf7xsG0nVmuYjhIrA9LVI5roVleIVRfpXinvQI kwi4S2fApMFlzrsDAXOhpqaN1CjxTIBF2qhXh3iaxYTusl0aceg/QyY9vCEnyVUyX8Wk aBohwwZVTSevY7Ua1+vvPoKN2rMUxLhQTf1+F2tBJjifcj21QqADEbById/jbIQyOoYO TVaw== X-Gm-Message-State: APuU4Z89pJb7j7n/j+kdhw1vmyCDxJUWHJJ1zw5WDRyxBBh3vebS+iml XhK4LG0yVNcPA4Nff8wBY6w73bdoE/GK9yw6OdGLbg1GJo5M3d9SNcxg3D/Hvg== X-Gm-Gg: AYBFou2vZUmLAaGiWNfphwoqUisFTfeGc1epFDquQqn5bHIe66BczdvFLibx0JIiYQX Czt8Ii506ntnPn+ZIxwXtaNsvHkfnwI6o7QbOnZKf0TK19QKy34rWSW15dqYMChl1yRsQ7R3evf bT2ORwXxiANbiaogiRZsX1DFGnQD2K5MN63h6jcjxK8J9ziBSPwY7idIQ9f4dNXlstZo8KPT7yS +WyvSzSgqRlRZDZAH0KKDpdufsynTfRlR3qNul/PTQKltLW+NZBRbRoFfKyWdcIMHU1Y5P6H5nj x/9ACToMHEg8PgPXZKn6WCGuU+hB36Y9gRIkgg9TI1iGCQF8QsIb3GwVjCHO1o51DJgLnJc+sE/ hQZUsoEvwDyhIh13fdg4zwWA54/SjaHryUOsRfZVW6hTfuKlkCj7rtKwdJ7iVTGkJJrhepS1srI fF8WHPbiF6FDt8Tl4vdzQTHVNqJzYH9rPJ+L33lIRUdwjsgpjqi5Q/U0UXCb3WBk/sr7/yWQ1Gq WsqZaDDvL2Q7rEW++wCXxwwETXOtowsCil2mtkvYqdypuBn+/leJnR0c4byfCg0uGRamVRqIQU9 G3y6OmkBfe/HbriFisKfkErS7J9PBJl8noxV16IQaMRhNPL80OqgjAPIVQ7+gg== X-Received: by 2002:a05:7022:f508:b0:143:54c6:6a5 with SMTP id a92af1059eb24-1b25d3303c7mr55771c88.37.1793909175492; Thu, 05 Nov 2026 12:06:15 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b245c772fdsm21837691c88.22.2026.11.05.12.06.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 12:06:14 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 9/9] libgphoto2: patch CVE-2026-120452 Date: Fri, 6 Nov 2026 09:05:52 +1300 Message-ID: <20261105200552.81303-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105200552.81303-1-ankur.tyagi85@gmail.com> References: <20261105200552.81303-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 20:06:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131937 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120452 Signed-off-by: Ankur Tyagi --- .../gphoto2/libgphoto2/CVE-2026-120452.patch | 40 +++++++++++++++++++ .../gphoto2/libgphoto2_2.5.34.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch new file mode 100644 index 0000000000..97e2318cbd --- /dev/null +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch @@ -0,0 +1,40 @@ +From 9fe9a565d4755d99255e34384bbb19f2a439b242 Mon Sep 17 00:00:00 2001 +From: TheProtagonist07 <63047129+TheProtagonist07@users.noreply.github.com> +Date: Wed, 28 Oct 2026 19:19:32 +0530 +Subject: [PATCH] jl2005c: bound thumbnail conversion by the real input length + +jl2005bcd_decompress() picks thumbnail_width/height from a device header +byte and then byte-swaps that many RGB565 samples starting at input+16. +When the device claims a 128x120 thumbnail but the input buffer is smaller, +the loop reads and writes about 30 KB past the heap buffer. + +Reject the conversion with GP_ERROR_CORRUPTED_DATA when the input is too +small. Addresses finding 3 of #1326. + +(cherry picked from commit 30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb) + +CVE: CVE-2026-120452 +Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb] +Signed-off-by: Ankur Tyagi +--- + camlibs/jl2005c/jl2005bcd_decompress.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/camlibs/jl2005c/jl2005bcd_decompress.c b/camlibs/jl2005c/jl2005bcd_decompress.c +index 8c3307fd6..1c8a73c5b 100644 +--- a/camlibs/jl2005c/jl2005bcd_decompress.c ++++ b/camlibs/jl2005c/jl2005bcd_decompress.c +@@ -123,6 +123,13 @@ jl2005bcd_decompress (unsigned char *output, unsigned char *input, + GP_DEBUG("No thumbnail is present!\n"); + return GP_ERROR_NOT_SUPPORTED; + } else { ++ /* thumbnail_width/height come from a device header byte; the ++ * RGB565 payload that follows the 16-byte header must actually ++ * be large enough for that many samples. */ ++ if (inputsize < 16 + 2 * thumbnail_width * thumbnail_height) { ++ GP_DEBUG("thumbnail larger than input\n"); ++ return GP_ERROR_CORRUPTED_DATA; ++ } + out = malloc(thumbnail_width * thumbnail_height * 3); + thumb = (uint16_t *)(input + 16); + for (i = 0; i < thumbnail_width * thumbnail_height; diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb index 488364b542..d8cf86ade2 100644 --- a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb @@ -13,6 +13,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/gphoto/${BP}.tar.xz;name=libgphoto2 \ file://40-libgphoto2.rules \ file://0001-configure-Filter-out-buildpaths-from-CC.patch \ file://CVE-2026-120451.patch \ + file://CVE-2026-120452.patch \ " SRC_URI[libgphoto2.sha256sum] = "51993f5d9bfb6b4e5925cbbe5883085791bff6f81bcacb8ffe1b783ce76d586a"