diff options
| author | Dana Robinson <43805+derobins@users.noreply.github.com> | 2023-08-02 20:59:26 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-08-02 20:59:26 (GMT) |
| commit | 11e28fe8b84586eb6d99339f45ff3e502e2c5b60 (patch) | |
| tree | b17c281c30e1946d6d062551f07a6b4bc196d781 /release_docs | |
| parent | f5c3963c18ef148622d620691dc9d202aa0b95ed (diff) | |
| download | hdf5-11e28fe8b84586eb6d99339f45ff3e502e2c5b60.zip hdf5-11e28fe8b84586eb6d99339f45ff3e502e2c5b60.tar.gz hdf5-11e28fe8b84586eb6d99339f45ff3e502e2c5b60.tar.bz2 | |
Fix CVE-2018-11202 (#3330)
A malformed file could result in chunk index memory leaks. Under most
conditions (i.e., when the --enable-using-memchecker option is NOT
used), this would result in a small memory leak and and infinite loop
and abort when shutting down the library. The infinite loop would be
due to the "free list" package not being able to clear its resources
so the library couldn't shut down. When the "using a memory checker"
option is used, the free lists are disabled so there is just a memory
leak with no abort on library shutdown.
The chunk index resources are now correctly cleaned up when reading
misparsed files and valgrind confirms no memory leaks.
Diffstat (limited to 'release_docs')
| -rw-r--r-- | release_docs/RELEASE.txt | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/release_docs/RELEASE.txt b/release_docs/RELEASE.txt index ab9f569..c76a66a 100644 --- a/release_docs/RELEASE.txt +++ b/release_docs/RELEASE.txt @@ -265,6 +265,20 @@ Bug Fixes since HDF5-1.14.0 release =================================== Library ------- + - Fixed CVE-2018-11202 + + A malformed file could result in chunk index memory leaks. Under most + conditions (i.e., when the --enable-using-memchecker option is NOT + used), this would result in a small memory leak and and infinite loop + and abort when shutting down the library. The infinite loop would be + due to the "free list" package not being able to clear its resources + so the library couldn't shut down. When the "using a memory checker" + option is used, the free lists are disabled so there is just a memory + leak with no abort on library shutdown. + + The chunk index resources are now correctly cleaned up when reading + misparsed files and valgrind confirms no memory leaks. + - Fixed an issue where an assert statement was converted to an incorrect error check statement |