Fix issues with empty or uninitialized link names #4322
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Converts an assertion in H5G_loc_find into a normal error check that checks for empty link names Initializes H5O_link_t structure early in H5G__ent_to_link to avoid trying to free potentially uninitialized memory Checks for an empty link name after H5MM_strndup in H5G__ent_to_link Fixes GitHub HDFGroup#4307
jhendersonHDF
added
Merge - To 1.14
Priority - 0. Blocker ⛔
jhendersonHDF
requested review from
lrknox,
derobins,
byrnHDF,
fortnern,
qkoziol,
vchoi-hdfgroup,
bmribler,
glennsong09,
mattjala and
brtnfld
as code owners
jhendersonHDF
commented
Apr 4, 2024
| @@ -410,9 +410,12 @@ H5G_loc_find(const H5G_loc_t *loc, const char *name, H5G_loc_t *obj_loc /*out*/) | |||
|
|
|||
| /* Check args. */ | |||
| assert(loc); | |||
| assert(name && *name); | |||
There was a problem hiding this comment.
This was failing in debug builds due to the assertion on *name, but would pass for release/production builds. That said, I don't think it's allowed to have an empty link name for an object, so I converted this to a regular error check.
|
This fixes the current CVE testing. It doesn't appear to be a missed issue, but rather a new issue that was masked by previous CVE problems. |
lrknox
approved these changes
Apr 4, 2024
byrnHDF
approved these changes
Apr 4, 2024
lrknox
pushed a commit
to lrknox/hdf5
that referenced
this pull request
Apr 4, 2024
Converts an assertion in H5G_loc_find into a normal error check that checks for empty link names Initializes H5O_link_t structure early in H5G__ent_to_link to avoid trying to free potentially uninitialized memory Checks for an empty link name after H5MM_strndup in H5G__ent_to_link Fixes GitHub HDFGroup#4307
lrknox
added a commit
that referenced
this pull request
Apr 4, 2024
* Remove VS ptable error from Known Problems (#4317) * Simply check for datatypes with unusual number of unused bits (#4309) Avoids potential undefined behavior in H5T_is_numeric_with_unusual_unused_bits * Fix issues with empty or uninitialized link names (#4322) Converts an assertion in H5G_loc_find into a normal error check that checks for empty link names Initializes H5O_link_t structure early in H5G__ent_to_link to avoid trying to free potentially uninitialized memory Checks for an empty link name after H5MM_strndup in H5G__ent_to_link Fixes GitHub #4307 * Fix h5py testing failure due to invalid datatype IDs (#4321) Fixes an issue where invalid datatype IDs are passed to application conversion functions in the case where the top-level conversion function is a library-internal function that operates on a container-like datatype, but one or more of the base datatype members are converted with an application conversion function. * Revise _Float16 configure checks (#4323) Run configure checks with and without CFLAGS/CMAKE_C_FLAGS since some compilers work in one case while not working in the other case Sync CMake configure checks with Autotools
lrknox
added a commit
to lrknox/hdf5
that referenced
this pull request
Apr 4, 2024
* Remove VS ptable error from Known Problems (HDFGroup#4317) * Simply check for datatypes with unusual number of unused bits (HDFGroup#4309) Avoids potential undefined behavior in H5T_is_numeric_with_unusual_unused_bits * Fix issues with empty or uninitialized link names (HDFGroup#4322) Converts an assertion in H5G_loc_find into a normal error check that checks for empty link names Initializes H5O_link_t structure early in H5G__ent_to_link to avoid trying to free potentially uninitialized memory Checks for an empty link name after H5MM_strndup in H5G__ent_to_link Fixes GitHub HDFGroup#4307 * Fix h5py testing failure due to invalid datatype IDs (HDFGroup#4321) Fixes an issue where invalid datatype IDs are passed to application conversion functions in the case where the top-level conversion function is a library-internal function that operates on a container-like datatype, but one or more of the base datatype members are converted with an application conversion function. * Revise _Float16 configure checks (HDFGroup#4323) Run configure checks with and without CFLAGS/CMAKE_C_FLAGS since some compilers work in one case while not working in the other case Sync CMake configure checks with Autotools
qkoziol
pushed a commit
to qkoziol/hdf5
that referenced
this pull request
Apr 8, 2024
Converts an assertion in H5G_loc_find into a normal error check that checks for empty link names Initializes H5O_link_t structure early in H5G__ent_to_link to avoid trying to free potentially uninitialized memory Checks for an empty link name after H5MM_strndup in H5G__ent_to_link Fixes GitHub HDFGroup#4307
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Converts an assertion in H5G_loc_find into a normal error check that checks for empty link names
Initializes H5O_link_t structure early in H5G__ent_to_link to avoid trying to free potentially uninitialized memory
Checks for an empty link name after H5MM_strndup in H5G__ent_to_link
Fixes GitHub #4307