mirrors/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2026-09-25 04:09:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix double-free issue in H5D__chunk_copy (#6160)

Browse Source 
Fix double-free caused by loss of buffer pointer after re-allocation

Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
This commit is contained in:
jhendersonHDF
2026-01-27 05:55:38 -06:00
committed by GitHub
co-authored by Larry Knox
parent 9268b803b7
commit dd3080a58c
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
release_docs/CHANGELOG.md
+9
View File
@@ -112,6 +112,15 @@ We would like to thank the many HDF5 community members who contributed to this r
## Library
### Fixed a double-free bug in H5D__chunk_copy
Fixed a double-free bug in the internal H5D__chunk_copy() function which occurred when a buffer was re-allocated without updating the original pointer freed later on.
Fixes GitHub issues [#6123](https://github.com/HDFGroup/hdf5/issues/6123)
[#6124](https://github.com/HDFGroup/hdf5/issues/6124)
[#6125](https://github.com/HDFGroup/hdf5/issues/6125)
[#6126](https://github.com/HDFGroup/hdf5/issues/6126)
[#6133](https://github.com/HDFGroup/hdf5/issues/6133)
### Fixes potential security issues
The get_name API functions allow passing NULL when querying the object name length. However, passing a non-NULL buffer with size == 0 will result in security vulnerability of invalid write. That was because the library wrote a null terminator to the buffer regardless of what the size of the buffer was as long as the buffer was non-NULL.
src/H5Dchunk.c
+2 -3
View File
@@ -7089,7 +7089,7 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
const H5S_extent_t *ds_extent_src, H5T_t *dt_src, const H5O_pline_t *pline_src,
H5O_copy_t *cpy_info)
{
H5D_chunk_it_ud3_t udata; /* User data for iteration callback */
H5D_chunk_it_ud3_t udata = {0}; /* User data for iteration callback */
H5D_chk_idx_info_t idx_info_dst; /* Dest. chunked index info */
H5D_chk_idx_info_t idx_info_src; /* Source chunked index info */
int sndims; /* Rank of dataspace */
@@ -7257,7 +7257,6 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed for raw data chunk");
/* Initialize the callback structure for the source */
memset(&udata, 0, sizeof udata);
udata.common.layout = &layout_src->u.chunk;
udata.common.storage = &layout_src->storage.u.chunk;
udata.file_src = f_src;
@@ -7308,11 +7307,11 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
} /* end for */
}
done:
/* I/O buffers may have been re-allocated */
buf = udata.buf;
bkg = udata.bkg;
done:
if (dt_dst && (H5T_close(dt_dst) < 0))
HDONE_ERROR(H5E_DATASET, H5E_CANTCLOSEOBJ, FAIL, "can't close temporary datatype");
if (dt_mem && (H5T_close(dt_mem) < 0))