From 6f70e3d2767a5046d5971816a9887c4c3ce3bdf2 Mon Sep 17 00:00:00 2001 From: Nayyar Date: Wed, 15 Jul 2026 07:15:04 +0530 Subject: [PATCH] validate free space section type during sinfo decode (#6476) * validate free space section type during sinfo decode * Update release_docs/CHANGELOG.md --------- Co-authored-by: naruto-lgtm Co-authored-by: Larry Knox --- release_docs/CHANGELOG.md | 4 ++++ src/H5FScache.c | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/release_docs/CHANGELOG.md b/release_docs/CHANGELOG.md index d56d1e19a84..db9e5af3e4e 100644 --- a/release_docs/CHANGELOG.md +++ b/release_docs/CHANGELOG.md @@ -151,6 +151,10 @@ The `h5repack` tool now obtains its default low and high library version bounds ## Library +### Validate free space section type during decode + + When loading a free space section info block, the per-section type byte read from the file was used directly to index the free space manager's section class array and to call the class `deserialize` callback, guarded only by an assertion that is removed in release builds. A corrupted or fuzzed file could supply a type beyond the number of registered classes, causing an out-of-bounds read of the class array and an indirect call through a bogus function pointer. `H5FS__cache_sinfo_deserialize()` now rejects a section type that is not less than the number of section classes. + ### Fixed a heap buffer overflow when decoding a shared message list When reading a shared object header message (SOHM) list from the metadata cache, `H5SM__cache_list_deserialize()` allocated the message array for `list_max` entries but drove the decode loop with the `num_messages` count read from the on-disk index header. A corrupted or malicious file whose `num_messages` exceeds `list_max` caused writes past the end of the array and reads past the end of the input buffer. The count is now validated against `list_max` before the loop runs. diff --git a/src/H5FScache.c b/src/H5FScache.c index 7d19f59976a..844685105b7 100644 --- a/src/H5FScache.c +++ b/src/H5FScache.c @@ -1012,6 +1012,13 @@ H5FS__cache_sinfo_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED l /* The type of this section */ sect_type = *image++; + /* Validate the section type before using it to index the class + * array, otherwise a corrupted file can drive an out-of-bounds + * read and an indirect call through a bogus function pointer. + */ + if (sect_type >= fspace->nclasses) + HGOTO_ERROR(H5E_FSPACE, H5E_CANTLOAD, NULL, "invalid free space section type"); + /* Call 'deserialize' callback for this section */ des_flags = 0; assert(fspace->sect_cls[sect_type].deserialize);