Skip to content

Commit cdfdc51

Browse files
author
Glenn Song
committed
Update CHANGELOG.md entry
1 parent 58cc0a3 commit cdfdc51

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

release_docs/CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -496,7 +496,7 @@ Simple example programs showing how to use complex number datatypes have been ad
496496
## Library
497497

498498
### Fixed security issue CVE-2025-2925
499-
H5C__load_entry() now checks for an image buffer length of 0 before calling realloc. A bug was occurring due to actual_len + H5C_IMAGE_EXTRA_SPACE being able to be 0 due to bad inputs. When realloc was called, it freed image, but got sent to done before new_image could be assigned to image. Because the pointer for image wasn't null, it is freed again in done, causing a double free bug.
499+
Actual_len + H5C_IMAGE_EXTRA_SPACE, which was used by H5MM_realloc as the size input, could equal 0 due to bad inputs. When H5MM_realloc was called, it freed image, but then could get sent to done before new_image could be assigned to image. Because the pointer for image wasn't null, it was freed again in done, causing a double-free vulnerability. H5C__load_entry() now checks for an image buffer length of 0 before calling H5MM_realloc.
500500

501501
Fixes issue Github issue #5383
502502

0 commit comments

Comments
 (0)