mirrors/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2026-09-25 04:09:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

Add CHANGELOG entry for fix for CVE-2025-7067 (#5937)

Browse Source 
Add changelog entry for CVE-2025-7067 fix, detailing heap buffer overflow resolution in H5FS__sinfo_serialize_node_cb().
This commit is contained in:
jhendersonHDF
2025-10-23 19:56:51 -05:00
committed by GitHub
parent 4202ae830c
commit 3266a56a97
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
release_docs/CHANGELOG.md
+6
View File
@@ -557,6 +557,12 @@ Added Fortran wrapper h5fdsubfiling_get_file_mapping_f() for the subfiling file
## Library
### Fixed security issue CVE-2025-7067
Fixed a heap buffer overflow in H5FS__sinfo_serialize_node_cb() by discarding file free space sections from the file free space manager when they are found to be invalid. Specifically crafted HDF5 files can result in an attempt to insert duplicate or overlapping file free space sections into a file free space manager, later resulting in a buffer overflow when the same free space section is serialized to the file multiple times.
Fixes GitHub issue #5577
### Fixed security issue CVE-2025-2915 and OSV-2024-381
Fixed a heap-based buffer overflow in H5F__accum_free caused by an integer overflow when calculating new_accum_size. Added validation in H5O__mdci_decode to detect and reject invalid values early, preventing the overflow condition.