Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for CVE-2016-4332 #3406

Merged
merged 2 commits into from
Aug 22, 2023
Merged

Fix for CVE-2016-4332 #3406

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ca85c05
Fix for CVE-2016-4332
Aug 22, 2023
3add9fa
Merge branch 'develop' into CVE_2016_4332_fix
lrknox Aug 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions release_docs/RELEASE.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,6 +283,18 @@ Bug Fixes since HDF5-1.14.0 release
===================================
Library
-------
- Fixed an assertion in a previous fix for CVE-2016-4332

An assert could fail when processing corrupt files that have invalid
shared message flags (as in CVE-2016-4332).

The assert statement in question has been replaced with pointer checks
that don't raise errors. Since the function is in cleanup code, we do
our best to close and free things, even when presented with partially
initialized structs.

Fixes CVE-2016-4332 and HDFFV-9950 (confirmed via the cve_hdf5 repo)

- Fixed a file space allocation bug in the parallel library for chunked
datasets

Expand Down
16 changes: 7 additions & 9 deletions src/H5Omessage.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -619,13 +619,12 @@ H5O__msg_free_mesg(H5O_mesg_t *mesg)
} /* end H5O__msg_free_mesg() */

/*-------------------------------------------------------------------------
* Function: H5O_msg_free_real
* Function: H5O_msg_free_real
*
* Purpose: Similar to H5O_msg_reset() except it also frees the message
* pointer.
* Purpose: Similar to H5O_msg_reset() except it also frees the message
* pointer
*
* Return: Success: NULL
* Failure: NULL
* Return: NULL (always)
*
*-------------------------------------------------------------------------
*/
Expand All @@ -634,16 +633,15 @@ H5O_msg_free_real(const H5O_msg_class_t *type, void *msg_native)
{
FUNC_ENTER_NOAPI_NOINIT_NOERR

/* check args */
assert(type);
/* Don't assert on args since this could be called in cleanup code */

if (msg_native) {
H5O__msg_reset_real(type, msg_native);
if (NULL != (type->free))
if (type && type->free)
(type->free)(msg_native);
else
H5MM_xfree(msg_native);
} /* end if */
}

FUNC_LEAVE_NOAPI(NULL)
} /* end H5O_msg_free_real() */
Expand Down