Fix CVE-2025-2926 #5841

bmribler · 2025-09-16T16:07:44Z

An image size was corrupted and decoded as 0 resulting in a NULL image buffer, which caused a NULL pointer dereference when the image being copied to the buffer. This PR adds the image size check.

Fixes #5384

Important

Fixes CVE-2025-2926 by adding an image size check in H5O__cache_chk_get_initial_load_size() to prevent NULL pointer dereference.

Security Fix:
- Fixes CVE-2025-2926 by adding a check for image size in H5O__cache_chk_get_initial_load_size() in H5Ocache.c to prevent NULL pointer dereference.
Documentation:
- Updated CHANGELOG.md to include details of the fix for CVE-2025-2926.

^{This description was created by}^{for eed45d8. You can customize this summary. It will automatically update as commits are pushed.}

bmribler · 2025-09-16T16:48:37Z

Umm, FYI, this PR only has the changes in H5Centry.c and RELEASE.txt. Sorry!

derobins · 2025-09-17T16:04:16Z

release_docs/RELEASE.txt

 ===================================
    Library
    -------
+    - Fixed CVE 2025 2926


Should use hyphens in the name, like other CVE issues

Hmm, I don't know how that happened. I always have hyphens... Thanks, Dana.

derobins · 2025-09-17T16:06:49Z

src/H5Cimage.c

+    if (H5C__decode_cache_image_header(f, cache_ptr, &p, image_len + 1) < 0)
        HGOTO_ERROR(H5E_CACHE, H5E_CANTDECODE, FAIL, "cache image header decode failed");
-    assert((size_t)(p - (uint8_t *)cache_ptr->image_buffer) < cache_ptr->image_len);
+    assert((size_t)(p - (uint8_t *)cache_ptr->image_buffer) < image_len);


Why not make this a real error check instead of an assert?

If H5C__decode_cache_image_header checks for overflow an assert is appropriate here. And if it doesn't, it should.

This change was merged into this PR by accident and that was fixed now. I'll check out about H5C__decode_cache_image_header() and create another PR instead.

This PR #5884 adds the missing overflow checks, @fortnern.

fortnern · 2025-09-24T15:53:26Z

src/H5Centry.c

    if (type->get_initial_load_size(udata, &len) < 0)
        HGOTO_ERROR(H5E_CACHE, H5E_CANTGET, NULL, "can't retrieve image size");
-    assert(len > 0);
+    if (len == 0)


Seems to me this should really be checked in the callbacks, and left as an assert here.

Do you know why the callback is returning len=0 without returning an error?

I fixed it and push the change soon

An image size was corrupted and decoded as 0 resulting in a NULL image buffer, which caused a NULL pointer dereference when the image being copied to the buffer. The invalid image size was caught in the PR #5710. This change catches right before the copying. Fixes GH issue #5384

fortnern

See questions about get_initial_load_size returning len==0

Added change entry

fortnern · 2025-10-16T21:43:00Z

So the CVE is already fixed without this PR? I think the check in this PR should just be an assertion (unless there's some case where we really can't catch it before here)

fortnern · 2025-10-16T21:44:15Z

We should only do enough non-assert checking as is necessary to guarantee a consistent internal state. Additional checking should be in the form of assertions.

bmribler · 2025-10-17T20:48:04Z

@fortnern The assert was already put back in the commit I mentioned in #5841 (comment). Sorry, I forgot that I did.

fortnern · 2025-10-28T00:59:04Z

There is no assert in H5O__cache_chk_get_initial_load_size() currently and this PR adds an error check instead of an assert. Is there a reason you think this should not be an assert instead?

fortnern

Please change this to an assertion or explain why it needs to be an error check. My understanding is the CVE was fixed by a different PR that added the check in the appropriate place, correct? Did that PR add a Changelog.md note? If so, no need for this one.

src/H5Ocache.c

bmribler · 2025-10-29T05:57:51Z

release_docs/CHANGELOG.md

+   Fixed a heap buffer overflow in H5FS__sinfo_serialize_node_cb() by discarding file free space sections from the file free space manager when they are found to be invalid. Specifically crafted HDF5 files can result in an attempt to insert duplicate or overlapping file free space sections into a file free space manager, later resulting in a buffer overflow when the same free space section is serialized to the file multiple times.
+
+   Fixes GitHub issue #5577
+


Hmm, I don't know how this entry got into my commit... I hope I didn't cause anything bad.

It seems to already be in develop, hopefully it gets fixed when it's merged

mattjala · 2025-10-29T15:24:09Z

Unused variable is causing the -Werror builds to fail

/home/runner/work/hdf5/hdf5/src/H5Ocache.c:599:31: error: unused variable ‘ret_value’ [-Werror=unused-variable]
  599 |     herr_t                    ret_value = SUCCEED;
      |                               ^~~~~~~~~

bmribler · 2025-10-29T21:51:24Z

Unused variable is causing the -Werror builds to fail

/home/runner/work/hdf5/hdf5/src/H5Ocache.c:599:31: error: unused variable ‘ret_value’ [-Werror=unused-variable]
  599 |     herr_t                    ret_value = SUCCEED;
      |                               ^~~~~~~~~

I'll fix it. Thank you!

lrknox · 2025-11-03T17:15:12Z

Committed a conflict in CHANGELOG.md. Previously reviews and approvals by fortnern, glennsong09, and mattjala dismissed by the non-code commit. Will approve and merge as soon as tests pass.

An image size was corrupted and decoded as 0 resulting in a NULL image buffer, which caused a NULL pointer dereference when the image being copied to the buffer. The invalid image size was caught in the PR HDFGroup#5710. This change catches right before the copying. Fixes GH issue HDFGroup#5384

bmribler requested review from brtnfld, byrnHDF, derobins, fortnern, glennsong09, jhendersonHDF, lrknox, mattjala, qkoziol and vchoi-hdfgroup as code owners September 16, 2025 16:07

github-project-automation bot added this to HDF5 - TRIAGE & TRACK Sep 16, 2025

github-project-automation bot moved this to To be triaged in HDF5 - TRIAGE & TRACK Sep 16, 2025

jhendersonHDF linked an issue Sep 16, 2025 that may be closed by this pull request

NULL Pointer Dereference in H5O__cache_chk_serialize #5384

Closed

byrnHDF assigned fortnern and glennsong09 Sep 17, 2025

derobins reviewed Sep 17, 2025

View reviewed changes

derobins changed the title ~~Fix CVE 2025 2926~~ Fix CVE-2025-2926 Sep 17, 2025

mattjala previously approved these changes Sep 18, 2025

View reviewed changes

nbagha1 moved this from To be triaged to Scheduled/On-Deck in HDF5 - TRIAGE & TRACK Sep 23, 2025

fortnern reviewed Sep 24, 2025

View reviewed changes

jhendersonHDF dismissed mattjala’s stale review via b36c123 September 24, 2025 15:58

jhendersonHDF force-pushed the fix_CVE-2025-2926 branch from a4678ff to b36c123 Compare September 24, 2025 15:58

fortnern requested changes Sep 24, 2025

View reviewed changes

github-project-automation bot moved this from Scheduled/On-Deck to In progress in HDF5 - TRIAGE & TRACK Sep 24, 2025

bmribler and others added 2 commits September 25, 2025 11:02

Moved the detection of invalid image len to where the value is obtained.

a717eb1

Added change entry

Merge branch 'develop' into fix_CVE-2025-2926

7cc1f4e

bmribler requested a review from fortnern September 25, 2025 15:27

Merge branch 'develop' into fix_CVE-2025-2926

daf6618

lrknox added Component - C Library Core C library issues (usually in the src directory) Component - Documentation Doxygen, markdown, etc. labels Oct 24, 2025

fortnern requested changes Oct 28, 2025

View reviewed changes

Change error checking of size to assert

f805585

ellipsis-dev bot reviewed Oct 28, 2025

View reviewed changes

src/H5Ocache.c Show resolved Hide resolved

Add this issue to the correct fix

f9a8267

bmribler requested a review from fortnern October 29, 2025 05:54

bmribler commented Oct 29, 2025

View reviewed changes

nbagha1 added this to the Release 2.0.0 milestone Oct 29, 2025

bmribler and others added 2 commits October 29, 2025 22:25

Removed a leftover line

1662fb3

Committing clang-format changes

eed45d8

mattjala previously approved these changes Oct 30, 2025

View reviewed changes

glennsong09 previously approved these changes Oct 31, 2025

View reviewed changes

fortnern previously approved these changes Nov 3, 2025

View reviewed changes

Merge branch 'develop' into fix_CVE-2025-2926

302922c

lrknox dismissed stale reviews from fortnern, glennsong09, and mattjala via 302922c November 3, 2025 17:10

lrknox merged commit d37b537 into develop Nov 3, 2025
190 checks passed

github-project-automation bot moved this from In progress to Done in HDF5 - TRIAGE & TRACK Nov 3, 2025

		Fixed a heap buffer overflow in H5FS__sinfo_serialize_node_cb() by discarding file free space sections from the file free space manager when they are found to be invalid. Specifically crafted HDF5 files can result in an attempt to insert duplicate or overlapping file free space sections into a file free space manager, later resulting in a buffer overflow when the same free space section is serialized to the file multiple times.

		Fixes GitHub issue #5577

Uh oh!

Fix CVE-2025-2926 #5841

Fix CVE-2025-2926 #5841

Uh oh!

Conversation

bmribler commented Sep 16, 2025 • edited by ellipsis-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bmribler commented Sep 16, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmribler Sep 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fortnern Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fortnern left a comment

Choose a reason for hiding this comment

Uh oh!

fortnern commented Oct 16, 2025

Uh oh!

fortnern commented Oct 16, 2025

Uh oh!

bmribler commented Oct 17, 2025

Uh oh!

fortnern commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fortnern left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattjala commented Oct 29, 2025

Uh oh!

bmribler commented Oct 29, 2025

Uh oh!

lrknox commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

bmribler commented Sep 16, 2025 •

edited by ellipsis-dev bot

Loading

bmribler Sep 27, 2025 •

edited

Loading

fortnern Sep 24, 2025 •

edited

Loading

fortnern commented Oct 28, 2025 •

edited

Loading

lrknox commented Nov 3, 2025 •

edited

Loading