Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CVE-2018-11202 #3330

Merged
merged 4 commits into from
Aug 2, 2023
Merged

Fix CVE-2018-11202 #3330

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6713ba2
Fixes CVE-2018-11202
derobins Aug 2, 2023
179f00f
Format source
derobins Aug 2, 2023
a277e9b
Rework to avoid const warning
derobins Aug 2, 2023
aa825c1
Add a flag to only clean index if created
derobins Aug 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions release_docs/RELEASE.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,6 +265,20 @@ Bug Fixes since HDF5-1.14.0 release
===================================
Library
-------
- Fixed CVE-2018-11202

A malformed file could result in chunk index memory leaks. Under most
conditions (i.e., when the --enable-using-memchecker option is NOT
used), this would result in a small memory leak and and infinite loop
and abort when shutting down the library. The infinite loop would be
due to the "free list" package not being able to clear its resources
so the library couldn't shut down. When the "using a memory checker"
option is used, the free lists are disabled so there is just a memory
leak with no abort on library shutdown.

The chunk index resources are now correctly cleaned up when reading
misparsed files and valgrind confirms no memory leaks.

- Fixed an issue where an assert statement was converted to an
incorrect error check statement

Expand Down
7 changes: 7 additions & 0 deletions src/H5Dchunk.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -961,6 +961,13 @@ H5D__chunk_init(H5F_t *f, const H5D_t *const dset, hid_t dapl_id)
HGOTO_ERROR(H5E_DATASET, H5E_CANTINIT, FAIL, "unable to set # of chunks for dataset");

done:
if (FAIL == ret_value) {
if (rdcc->slot)
rdcc->slot = H5FL_SEQ_FREE(H5D_rdcc_ent_ptr_t, rdcc->slot);

if (sc->ops->dest && (sc->ops->dest)(&idx_info) < 0)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe we need to keep track of whether the init function was called. Using b-tree v1 as an example the dest callback appears to always call H5UC_DEC on the shared data, and H5UC_DEC assumes the shared data exists.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I'll add a flag when I get back from lunch.

HDONE_ERROR(H5E_DATASET, H5E_CANTFREE, FAIL, "unable to release chunk index info");
}
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5D__chunk_init() */

Expand Down