validate free space section type during sinfo decode (#6476)

* validate free space section type during sinfo decode

* Update release_docs/CHANGELOG.md

---------

Co-authored-by: naruto-lgtm <naruto-lgtm@users.noreply.github.com>
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>

release_docs/CHANGELOG.md

@@ -151,6 +151,10 @@ The `h5repack` tool now obtains its default low and high library version bounds
 
 ## Library
 
+### Validate free space section type during decode
+
+   When loading a free space section info block, the per-section type byte read from the file was used directly to index the free space manager's section class array and to call the class `deserialize` callback, guarded only by an assertion that is removed in release builds. A corrupted or fuzzed file could supply a type beyond the number of registered classes, causing an out-of-bounds read of the class array and an indirect call through a bogus function pointer. `H5FS__cache_sinfo_deserialize()` now rejects a section type that is not less than the number of section classes.
+
 ### Fixed a heap buffer overflow when decoding a shared message list
 
    When reading a shared object header message (SOHM) list from the metadata cache, `H5SM__cache_list_deserialize()` allocated the message array for `list_max` entries but drove the decode loop with the `num_messages` count read from the on-disk index header. A corrupted or malicious file whose `num_messages` exceeds `list_max` caused writes past the end of the array and reads past the end of the input buffer. The count is now validated against `list_max` before the loop runs.

src/H5FScache.c

@@ -1012,6 +1012,13 @@ H5FS__cache_sinfo_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED l
                 /* The type of this section */
                 sect_type = *image++;
 
+                /* Validate the section type before using it to index the class
+                 * array, otherwise a corrupted file can drive an out-of-bounds
+                 * read and an indirect call through a bogus function pointer.
+                 */
+                if (sect_type >= fspace->nclasses)
+                    HGOTO_ERROR(H5E_FSPACE, H5E_CANTLOAD, NULL, "invalid free space section type");
+
                 /* Call 'deserialize' callback for this section */
                 des_flags = 0;
                 assert(fspace->sect_cls[sect_type].deserialize);