Fix CVE-2025-2310 #5872
Merged
Fix CVE-2025-2310 #5872
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mattjala
added
the
Component - C Library
mattjala
requested review from
bmribler,
brtnfld,
byrnHDF,
derobins,
fortnern,
glennsong09,
jhendersonHDF,
lrknox,
qkoziol and
vchoi-hdfgroup
as code owners
mattjala
force-pushed
the
cve-2025-2310-fix
branch
from
2117873 to
a5a0b30
Compare
bmribler
previously approved these changes
Oct 6, 2025
bmribler
reviewed
Oct 6, 2025
src/H5Oattr.c
Outdated
| HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding"); | ||
|
|
||
| /* Verify that retrieved name length (including null byte) is valid */ | ||
| if (name_len <= 1) |
There was a problem hiding this comment.
Shouldn't we find where name_len was decoded?
There was a problem hiding this comment.
It was decoded earlier in this function - UINT16DECODE(p, name_len); at H5Oattr.c:169. I wanted to put this check next to the other name_len value check.
There was a problem hiding this comment.
Hmm, I think this check is more appropriate right after the value being decoded.
jhendersonHDF
requested changes
Oct 8, 2025
github-project-automation
bot
moved this from To be triaged
to In progress
in HDF5 - TRIAGE & TRACK
mattjala
force-pushed
the
cve-2025-2310-fix
branch
from
a5a0b30 to
cd43ae5
Compare
jhendersonHDF
approved these changes
Oct 9, 2025
bmribler
approved these changes
Oct 9, 2025
github-project-automation
bot
moved this from In progress
to Done
in HDF5 - TRIAGE & TRACK
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Malformed files can have a zero name-length, which when subtracted lead to an overflow and an out-of-bounds read.
Check that name length is not too small in addition to checking for an overflow directly.
Important
Fixes overflow and out-of-bounds read in
H5O__attr_decode()by ensuringname_lenis greater than 1 inH5Oattr.c.H5O__attr_decode()inH5Oattr.c, added a check to ensurename_lenis greater than 1 to prevent overflow and out-of-bounds read.This description was created by
for a5a0b30. You can customize this summary. It will automatically update as commits are pushed.