* Various improvement in documentation and a decoding function
- Improves documentation on the type size when creating/accessing a compound datatype with no predefined struct (GH issue #5371)
- Provides better description of the min_meta_perc and min_raw_perc arguments in the H5Pset_page_buffer_size() (GH issue #5711)
- Adds error checkings to an internal decoding function
* Corrected the checks, the base address equals the end-of-file is valid.
* Skip for multi-file and split drivers when validating addresses against stored_eof
* Committing clang-format changes
* Remove incorrect name
* Fix typos
* Modified description of type_size arguments
* Used a more robust condition when checking EOF
* Corrected incorrect conflict resolving
* Update src/H5Fsuper_cache.c
Co-authored-by: Neil Fortner <fortnern@gmail.com>
* Update src/H5Fsuper_cache.c
Co-authored-by: Neil Fortner <fortnern@gmail.com>
* Committing clang-format changes
* Modified per feedbacks.
* Fix comparison per feedbacks
* Omit unused parameter name in a catch block
---------
Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Neil Fortner <fortnern@gmail.com>
* Fix NULL pointer access when H5A_operator2_t is NULL
Passing NULL for the callback function pointer to H5Aiterate2 and
H5Aiterate_by_name was not detected, leading to a subsequent access
of an uninitialized pointer. Add a check for this "no operator
specified" case in both functions so they fail gracefully instead.
Fixes GHSA-r7g4-hv2f-5c66 - CVE-2025-9274
* Fix format
* Fix Java test to handle NULL callback to H5Aiterate2
The H5D__chunk_lock() call has a matching H5D__chunk_unlock() in normal conditions, but it is missing when an operation fails after H5D__chunk_lock() succeeds.
* Updated h5dump --xml
The location of the files HDF5-File.xsd and HDF5-File.dtd no longer exists, and
the files were added to the repo (PR #5490). Before the --xml is actually removed,
running the h5dump tests will fail. This PR updated h5dump and the expected output
to use the correct files' location and actually completed the ticket HELP-2668.
* Added missing expected files from the previous commit
* Fixed typo
* Made corrections per review feedbacks
* Committing clang-format changes
* Missing files from previous commit
* Use valid URL for xmlns
---------
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
Link checker can't access the acm url, hence will fail. The change in
this PR is a workaround to provide the url but prevent the link checker
from accessing it. Please do not add https://.
User report:
When a file is corrupted such that an array datatype's size, the number of elements,
and the element size are not in agreement, it can trigger an out of bounds read.
(private GH issue: GHSA-gh44-7wpq-622f)
Added a validation to ensure the above are in agreement.
Fixes security issue by treating non-NULL buffer with size 0 as length-only query in get_name API functions.
Behavior:
Modify get_name API functions to treat (buffer != NULL, size == 0) as length-only queries, preventing undefined behavior.
Fix applied to H5Aget_name, H5Aget_name_by_idx, H5Fget_name, H5Gget_objname_by_idx, H5Iget_name, H5Lget_name_by_idx, H5Rget_file_name, H5Rget_obj_name, H5Rget_attr_name, and 8 other functions.
Tests:
Update test/links.c, test/tattr.c, test/tfile.c, test/titerate.c, and test/trefer.c to verify new behavior with non-null buffer and size 0.
Documentation:
Update comments in H5A.c, H5F.c, H5Gdeprec.c, H5I.c, H5L.c, H5R.c, and H5Rdeprec.c to reflect new behavior.t]@users.noreply.github.com>
Moved HDF5 2.0 release page from the github.io repo to the HDF5 repo's documentation and added information about release 2.0 and compatibility with the previous release.
When two entries in the cache image have the same address, the library
did not fail and later crashed.
The cache reconstruction functions now detect duplicate addresses. When
a failure occurs during the reconstruction, the cache is not clean properly.
H5C__reconstruct_cache_contents now expunges any prefetched entries that
were already added to the cache during the reconstruction.
An image size was corrupted and decoded as 0 resulting in a NULL image buffer,
which caused a NULL pointer dereference when the image being copied to the buffer.
The invalid image size was caught in the PR #5710. This change catches right
before the copying.
Fixes GH issue #5384
When H5G__dense_iterate failed early, the allocated H5O_link_t structures were never populated, causing cleanup code to read uninitialized lnk->type values and attempt to free invalid pointers.
The structures are now initialized with proper values and NULL pointers immediately after allocation.
Fixes GitHub #5375
Add buffer overflow checks to H5C__decode_cache_image_header() in H5Cimage.c for security hardening.
Security Hardening:
Add buffer overflow checks in H5C__decode_cache_image_header() in H5Cimage.c.
Use H5_IS_BUFFER_OVERFLOW() to verify buffer space before accessing elements.
Checks added for signature, version, flags, image data length, and number of entries.
Misc:
Adjust H5C__reconstruct_cache_contents() to use updated buffer handling logic.
* Fixes CVE-2025-6750
A heap buffer overflow occurred because an mtime message was not properly decoded, resulting in a buffer of size 0 being passed into the encoder.
This PR added decoding for both old and new mtime messages which will allow invalid message size to be detected.
Fixes#5549
The GitHub issue #5579 included several security vulnerabilities in function
H5C__reconstruct_cache_entry().
This PR addressed them by:
- adding buffer size argument to the function
- adding buffer overflow checks
- adding input validations
- releasing allocated resource on failure
These changes addressed the crashes reported. However, there is a skiplist
crash during the unwinding process that has to be investigated.
This PR addresses the root cause of the issue by adding a sanity-check immediately
after reading the file space page size from the file.
The same fuzzer in GH-5376 was used to verify that the assert before the vulnerability
had occurred and that an error indicating a corrupted file space page size replaced it.
This issue was reported in GH-5376 as a heap-use-after-free vulnerability in
one of the free lists. It appeared that the library came to this vulnerability
after it encountered an undetected reading of a bad value. The fuzzer now failed
with an appropriate error message.
* Changed comment style to avoid long line issue.
* Update H5Mpublic.h for clang format
---------
Co-authored-by: Dana Robinson <43805+derobins@users.noreply.github.com>
* Add release information to enum constants - Part 1
- Added \since to enum constants added in 1.8.x versions
- Removed unnecessary continuation backslashes in doxygen comments; they
are displayed in the generated output.
Added the alias \callback_note to APIs with a user callback function. The note is
brief and refers to a more detail note in a central place, i.e., alias cpp_c_api_note.
Fixes issue GH-5089
H5O__visit() uses the object information to be returned to the
application, so when the application did not request for certain
information, they were not available to H5O__visit. This lack of
information caused incorrect behavior down the road.
We now call H5O_get_info again providing H5O_INFO_BASIC for "fields",
so we can obtain correct object information for H5O__visit to use.
Fixes#4941
Added another argument, expected node level, to H5B__iterate_helper to pass down
to H5B__cache_deserialize for checking the decoded node level. When this expected
level is not known, the new macro H5_UNKNOWN_NODELEVEL (-1) will be used for not
checking the level.
Fixes GH-4432
In H5F__accum_reset(), when H5F__accum_flush() failed, the freeing of
f_sh->accum.buf was never reached, causing resource leak.
@fortnern added the third argument to H5F__accum_reset() so we can free
f_sh->accum.buf when we close the file, that is, when H5F__accum_reset()
is called from the H5F__dest() route, and can leave the accumulator in place
otherwise.
H5LTfind_dataset() returns true for non-existing datasets because it only compares up to the length of the searched string, such as "Day" vs "DayNight" (issue GH-4780).
This PR applied the user's patch and added tests.
* Fixes a segfault in h5dump
The B-tree node level was corrupted, resulting in a segfault later.
This PR adds a check to detect when the node level is greater than
the number of entries and issue an error instead.
Fixes GH-4432
User's application segfaulted because the returned value H5I_BADID wasn't
detected when H5I_get_type() was called. This PR adds checks for invalid
file/group identifiers passed into H5Gmove2.
This defect occurs in many other places, hence, issue GH-4764.
Fixes#4737
This PR switches H5I_object() and H5I_object_verify() to H5VL_vol_object() and H5VL_vol_object_verify(), respectively, in the H5M APIs and H5Gdeprec (was left out by mistake). This completes the fixes of issue GH-4730.
This PR switches H5I_object() to H5VL_vol_object() in H5O and H5T APIs. H5M is the last one and left out of this PR because it needs more work
in documentation and there is no test for the API functions.
Fixes GH-4730
- Verified that the listed functions do not include null terminator in the returned length
- Improved some of the tests
- Corrected documentation
Fixes GH-4704
* Casted a positive int to size_t
This PR is part of the incremental switching H5I_object() and H5I_object_verify()
to their VOL counterpart, H5VL_object() and H5VL_vol_object_verify(), a newly addedinternal function.
Fixes GH-4730 partially.
* Fix incorrect VOL vs. non-VOL calls
H5Lget_info2() called H5I_object() instead of H5VL_vol_object() crashed
user application.
This is a wide-spread issue (GH-4730) but this PR only addresses GH-4705.
* Remove an incorrect change
Added functionality tests for the following APIs:
H5Rget_file_name
H5Rget_obj_name
H5Rget_attr_name
Also removed "+1" when returning a name length in H5R__get_attr_name().
The exter "+1" gave an incorrect value for the length of the referenced
object's attribute name.
Fixed GH-4447
* Fix Fortran test
The C API H5Rget_attr_name incorrectly added 1 to the length of the
referenced object's attribute name, so the Fortran API h5rget_attr_name_f
removed 1 from the returned value to accommodate the incorrectness.
This PR fixes H5Rget_attr_name so this workaround in h5rget_attr_name_f
is no longer needed.
* Add test H5Aget_name against H5Rget_attr_name
* Replace incorrect use of an internal function
In some API functions, the internal function H5I_object() was used instead
of H5I_object_verify(), which verifies the type of an ID argument. So
when an inappropriate ID was passed in to the affected API, it was accepted.
This behavior can cause issues at a later time, including a segfault, as
reported in issue #GH-4656.
The fix was applied to the following functions:
H5Fget_intent()
H5Fget_fileno()
H5Fget_freespace()
H5Fget_create_plist()
H5Fget_access_plist()
H5Fget_vfd_handle()
H5Dvlen_get_buf_size()
H5Fget_mdc_config()
H5Fset_mdc_config()
H5Freset_mdc_hit_rate_stats()
Fixes GH-4662
The buffer size for checksum was smaller than H5_SIZEOF_CHKSUM, causing an
overflow while calculating the offset to the checksum in the buffer.
A check was added so H5F_get_checksums would fail appropriately in all
of its occurrences.
Fix gh-4434
* Correct the high-level library link
The link currently used points to 1.13 release. Changed to use the md file instead.
* Update Doxyfile for md files
* Update to include md files
Added img/images_to_copy.dox as a temporary solution because doxygen didn't copy
the images used in the examples/*.html files - will investigate more. This was
necessary for the links to intro_SWMR.html and intro_VDS.html.
bmribler
