From 3fa338013907494ccfe93b8e22d89185a39067ff Mon Sep 17 00:00:00 2001 From: jhendersonHDF Date: Fri, 24 Mar 2023 09:53:46 -0500 Subject: Fix a memory corruption issue in H5S__point_project_simple (#2627) --- release_docs/RELEASE.txt | 14 ++++++++++++++ src/H5Spoint.c | 2 +- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/release_docs/RELEASE.txt b/release_docs/RELEASE.txt index ab10311..d518f2f 100644 --- a/release_docs/RELEASE.txt +++ b/release_docs/RELEASE.txt @@ -240,6 +240,20 @@ Bug Fixes since HDF5-1.10.9 release =================================== Library ------- + - Fixed a memory corruption issue that can occur when reading + from a dataset using a hyperslab selection in the file + dataspace and a point selection in the memory dataspace + + When reading from a dataset using a hyperslab selection in + the dataset's file dataspace and a point selection in the + dataset's memory dataspace where the file dataspace's "rank" + is greater than the memory dataspace's "rank", memory corruption + could occur due to an incorrect number of selection points + being copied when projecting the point selection onto the + hyperslab selection's dataspace. + + (JTH - 2023/03/23) + - Fix CVE-2021-37501 / GHSA-rfgw-5vq3-wrjf Check for overflow when calculating on-disk attribute data size. diff --git a/src/H5Spoint.c b/src/H5Spoint.c index b7f2a5e..94a2aa1 100644 --- a/src/H5Spoint.c +++ b/src/H5Spoint.c @@ -2162,7 +2162,7 @@ H5S__point_project_simple(const H5S_t *base_space, H5S_t *new_space, hsize_t *of /* Copy over the point's coordinates */ HDmemset(new_node->pnt, 0, sizeof(hsize_t) * rank_diff); H5MM_memcpy(&new_node->pnt[rank_diff], base_node->pnt, - (new_space->extent.rank * sizeof(hsize_t))); + (base_space->extent.rank * sizeof(hsize_t))); /* Keep the order the same when copying */ if (NULL == prev_node) -- cgit v0.12