diff options
| author | Binh-Minh Ribler <bmribler@hdfgroup.org> | 2020-07-06 07:55:14 (GMT) |
|---|---|---|
| committer | Binh-Minh Ribler <bmribler@hdfgroup.org> | 2020-07-06 07:55:14 (GMT) |
| commit | 55377dc855d1431991d996de13a52bf562a5f2fe (patch) | |
| tree | 824b6d2f4d356808bd9311dfe7d8730e521782f2 /release_docs | |
| parent | 6c615b88035361fcc4e79a40dd2ffba0af306ad0 (diff) | |
| download | hdf5-55377dc855d1431991d996de13a52bf562a5f2fe.zip hdf5-55377dc855d1431991d996de13a52bf562a5f2fe.tar.gz hdf5-55377dc855d1431991d996de13a52bf562a5f2fe.tar.bz2 | |
Fix HDFFV-10591
Description:
h52gif produced a segfault when a buffer overflow occurred because
the data size was corrupted and became very large. This commit added
a check on the data size against the buffer size to prevent the segfault.
It also added error reporting to h52gif to display an error message
instead of silently exiting when the failure occurred.
Platforms tested:
Linux/64 (jelly)
Diffstat (limited to 'release_docs')
| -rw-r--r-- | release_docs/RELEASE.txt | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/release_docs/RELEASE.txt b/release_docs/RELEASE.txt index 1949d5b..46855b9 100644 --- a/release_docs/RELEASE.txt +++ b/release_docs/RELEASE.txt @@ -329,6 +329,18 @@ Bug Fixes since HDF5-1.8.21 Library ------- + - Fixed CVE-2018-17435 + + The tool h52gif produced a segfault when the size of an attribute + message was corrupted and caused a buffer overflow. + + The problem was fixed by verifying the attribute message's size + against the buffer size before accessing the buffer. h52gif was + also fixed to display the failure instead of silently exiting + after the segfault was eliminated. + + (BMR - 2020/6/19, HDFFV-10591) + - Fixed user-created data access properties not existing in the property list returned by H5Dget_access_plist. Thanks to Steven Varga for submitting a reproducer and a patch. |