Fix CVE-2025-2926 #5841

bmribler · 2025-09-16T16:07:44Z

An image size was corrupted and decoded as 0 resulting in a NULL image buffer, which caused a NULL pointer dereference when the image being copied to the buffer. This PR adds the image size check.

Fixes #5384

Important

Fix CVE-2025-2926 by adding image size check in H5O__cache_chk_get_initial_load_size() to prevent NULL pointer dereference.

Security Fix:
- Added image size check in H5O__cache_chk_get_initial_load_size() in H5Ocache.c to prevent NULL pointer dereference.
- Updated CHANGELOG.md to document the fix for CVE-2025-2926.
Misc:
- Fixes GitHub issue NULL Pointer Dereference in H5O__cache_chk_serialize #5384.

^{This description was created by}^{for f9a8267. You can customize this summary. It will automatically update as commits are pushed.}

bmribler · 2025-09-16T16:48:37Z

Umm, FYI, this PR only has the changes in H5Centry.c and RELEASE.txt. Sorry!

derobins · 2025-09-17T16:04:16Z

release_docs/RELEASE.txt

 ===================================
    Library
    -------
+    - Fixed CVE 2025 2926


Should use hyphens in the name, like other CVE issues

Hmm, I don't know how that happened. I always have hyphens... Thanks, Dana.

derobins · 2025-09-17T16:06:49Z

src/H5Cimage.c

+    if (H5C__decode_cache_image_header(f, cache_ptr, &p, image_len + 1) < 0)
        HGOTO_ERROR(H5E_CACHE, H5E_CANTDECODE, FAIL, "cache image header decode failed");
-    assert((size_t)(p - (uint8_t *)cache_ptr->image_buffer) < cache_ptr->image_len);
+    assert((size_t)(p - (uint8_t *)cache_ptr->image_buffer) < image_len);


Why not make this a real error check instead of an assert?

If H5C__decode_cache_image_header checks for overflow an assert is appropriate here. And if it doesn't, it should.

This change was merged into this PR by accident and that was fixed now. I'll check out about H5C__decode_cache_image_header() and create another PR instead.

This PR #5884 adds the missing overflow checks, @fortnern.

fortnern · 2025-09-24T15:53:26Z

src/H5Centry.c

    if (type->get_initial_load_size(udata, &len) < 0)
        HGOTO_ERROR(H5E_CACHE, H5E_CANTGET, NULL, "can't retrieve image size");
-    assert(len > 0);
+    if (len == 0)


Seems to me this should really be checked in the callbacks, and left as an assert here.

Do you know why the callback is returning len=0 without returning an error?

I fixed it and push the change soon

An image size was corrupted and decoded as 0 resulting in a NULL image buffer, which caused a NULL pointer dereference when the image being copied to the buffer. The invalid image size was caught in the PR #5710. This change catches right before the copying. Fixes GH issue #5384

fortnern

See questions about get_initial_load_size returning len==0

Added change entry

fortnern · 2025-09-25T19:12:23Z

I think we still need to get to the bottom of this. I did some digging and it looks like the size in the udata comes from a continuation message, but H5O__cont_decode() checks for size == 0. Can you try to figure out how it's getting past that check?

bmribler · 2025-09-27T06:46:24Z

@fortnern I believe this commit took care of the len=0 issue. Although, I'm not exactly sure how that commit is not listed in the changed files of #5841...

fortnern · 2025-10-10T19:26:29Z

@fortnern I believe this commit took care of the len=0 issue. Although, I'm not exactly sure how that commit is not listed in the changed files of #5841...

This check isn't as close to the file as it could be. As I mentioned previously, the udata->size in that function should come from H5O__cont_decode(), which already has a check for size == 0. Can you try to figure out how that was bypassed?

bmribler · 2025-10-16T17:45:59Z

@fortnern I believe this commit took care of the len=0 issue. Although, I'm not exactly sure how that commit is not listed in the changed files of #5841...

This check isn't as close to the file as it could be. As I mentioned previously, the udata->size in that function should come from H5O__cont_decode(), which already has a check for size == 0. Can you try to figure out how that was bypassed?

Oh, it did catch:
H5Ocont.c line 104 in H5O__cont_decode(): invalid continuation chunk size (0)

I thought we wanted additional checking too.

fortnern · 2025-10-16T21:43:00Z

So the CVE is already fixed without this PR? I think the check in this PR should just be an assertion (unless there's some case where we really can't catch it before here)

fortnern · 2025-10-16T21:44:15Z

We should only do enough non-assert checking as is necessary to guarantee a consistent internal state. Additional checking should be in the form of assertions.

bmribler · 2025-10-17T20:48:04Z

@fortnern The assert was already put back in the commit I mentioned in #5841 (comment). Sorry, I forgot that I did.

fortnern · 2025-10-28T00:59:04Z

There is no assert in H5O__cache_chk_get_initial_load_size() currently and this PR adds an error check instead of an assert. Is there a reason you think this should not be an assert instead?

fortnern

Please change this to an assertion or explain why it needs to be an error check. My understanding is the CVE was fixed by a different PR that added the check in the appropriate place, correct? Did that PR add a Changelog.md note? If so, no need for this one.

ellipsis-dev · 2025-10-28T21:48:57Z

src/H5Ocache.c

    assert(udata);
    assert(udata->oh);
    assert(image_len);
+    assert(udata->size);


The runtime check for udata->size==0 was removed and replaced with an assert. In production builds, asserts may be disabled, so a corrupted image size of 0 won’t be caught, possibly leading to a NULL pointer dereference. Please retain a runtime error check (e.g. using HGOTO_ERROR) to ensure the image size is nonzero.

bmribler · 2025-10-29T05:57:51Z

release_docs/CHANGELOG.md

+   Fixed a heap buffer overflow in H5FS__sinfo_serialize_node_cb() by discarding file free space sections from the file free space manager when they are found to be invalid. Specifically crafted HDF5 files can result in an attempt to insert duplicate or overlapping file free space sections into a file free space manager, later resulting in a buffer overflow when the same free space section is serialized to the file multiple times.
+
+   Fixes GitHub issue #5577
+


Hmm, I don't know how this entry got into my commit... I hope I didn't cause anything bad.

bmribler requested review from brtnfld, byrnHDF, derobins, fortnern, glennsong09, jhendersonHDF, lrknox, mattjala, qkoziol and vchoi-hdfgroup as code owners September 16, 2025 16:07

github-project-automation bot added this to HDF5 - TRIAGE & TRACK Sep 16, 2025

github-project-automation bot moved this to To be triaged in HDF5 - TRIAGE & TRACK Sep 16, 2025

jhendersonHDF linked an issue Sep 16, 2025 that may be closed by this pull request

NULL Pointer Dereference in H5O__cache_chk_serialize #5384

Open

byrnHDF assigned fortnern and glennsong09 Sep 17, 2025

derobins reviewed Sep 17, 2025

View reviewed changes

derobins changed the title ~~Fix CVE 2025 2926~~ Fix CVE-2025-2926 Sep 17, 2025

mattjala previously approved these changes Sep 18, 2025

View reviewed changes

nbagha1 moved this from To be triaged to Scheduled/On-Deck in HDF5 - TRIAGE & TRACK Sep 23, 2025

fortnern reviewed Sep 24, 2025

View reviewed changes

jhendersonHDF dismissed mattjala’s stale review via b36c123 September 24, 2025 15:58

jhendersonHDF force-pushed the fix_CVE-2025-2926 branch from a4678ff to b36c123 Compare September 24, 2025 15:58

fortnern requested changes Sep 24, 2025

View reviewed changes

github-project-automation bot moved this from Scheduled/On-Deck to In progress in HDF5 - TRIAGE & TRACK Sep 24, 2025

bmribler and others added 2 commits September 25, 2025 11:02

Moved the detection of invalid image len to where the value is obtained.

a717eb1

Added change entry

Merge branch 'develop' into fix_CVE-2025-2926

7cc1f4e

bmribler requested a review from fortnern September 25, 2025 15:27

bmribler requested a review from mattjala September 25, 2025 15:27

Committing clang-format changes

05369d0

bmribler mentioned this pull request Sep 27, 2025

Add buffer overflow detection #5884

Merged

Merge branch 'develop' into fix_CVE-2025-2926

daf6618

lrknox added Component - C Library Core C library issues (usually in the src directory) Component - Documentation Doxygen, markdown, etc. labels Oct 24, 2025

fortnern requested changes Oct 28, 2025

View reviewed changes

Change error checking of size to assert

f805585

ellipsis-dev bot reviewed Oct 28, 2025

View reviewed changes

Add this issue to the correct fix

f9a8267

bmribler requested a review from fortnern October 29, 2025 05:54

bmribler commented Oct 29, 2025

View reviewed changes

		Fixed a heap buffer overflow in H5FS__sinfo_serialize_node_cb() by discarding file free space sections from the file free space manager when they are found to be invalid. Specifically crafted HDF5 files can result in an attempt to insert duplicate or overlapping file free space sections into a file free space manager, later resulting in a buffer overflow when the same free space section is serialized to the file multiple times.

		Fixes GitHub issue #5577

Uh oh!

Uh oh!

Fix CVE-2025-2926 #5841

Are you sure you want to change the base?

Fix CVE-2025-2926 #5841

Conversation

bmribler commented Sep 16, 2025 • edited by ellipsis-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bmribler commented Sep 16, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmribler Sep 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fortnern Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fortnern left a comment

Choose a reason for hiding this comment

Uh oh!

fortnern commented Sep 25, 2025

Uh oh!

bmribler commented Sep 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fortnern commented Oct 10, 2025

Uh oh!

bmribler commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fortnern commented Oct 16, 2025

Uh oh!

fortnern commented Oct 16, 2025

Uh oh!

bmribler commented Oct 17, 2025

Uh oh!

fortnern commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fortnern left a comment

Choose a reason for hiding this comment

Uh oh!

ellipsis-dev bot Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

bmribler commented Sep 16, 2025 •

edited by ellipsis-dev bot

Loading

bmribler Sep 27, 2025 •

edited

Loading

fortnern Sep 24, 2025 •

edited

Loading

bmribler commented Sep 27, 2025 •

edited

Loading

bmribler commented Oct 16, 2025 •

edited

Loading

fortnern commented Oct 28, 2025 •

edited

Loading