Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix segfault in ROS3 credential parsing #4736

Merged
merged 2 commits into from
Aug 21, 2024
Merged

Fix segfault in ROS3 credential parsing #4736

merged 2 commits into from
Aug 21, 2024

Conversation

mattjala
Copy link
Contributor

The whitespace trimming could sometimes run off the end of the buffer and segfault.

Fixes an issue where, if two profiles were provided in the same file, the information provided in the second would overwrite the first in unpredictable ways. Now, parsing stops after the first profile. (This is the result of resetting the found_setting flag.)

@mattjala mattjala added Merge - To 1.14 This needs to be merged to HDF5 1.14 Priority - 2. Medium ⏹ It would be nice to have this in the next release Component - C Library Core C library issues (usually in the src directory) Type - Improvement Improvements that don't add a new feature or functionality labels Aug 20, 2024
@mattjala mattjala self-assigned this Aug 20, 2024
jhendersonHDF
jhendersonHDF reviewed Aug 20, 2024
View reviewed changes
src/H5FDs3comms.c
while (!isspace(setting_pointers[setting_i][buffer_i]))
buffer_i++;
setting_pointers[setting_i][buffer_i] = '\0';
end = strlen(line_buffer) - 1;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Be careful that the length of line_buffer isn't 0 here, which would cause end to wrap around.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be covered by the earlier check on line 1810 that throws an errors if *(line_buffer + 1) == 0.

jhendersonHDF
jhendersonHDF reviewed Aug 20, 2024
View reviewed changes
src/H5FDs3comms.c Outdated Show resolved Hide resolved
@lrknox lrknox merged commit 4791d34 into HDFGroup:develop Aug 21, 2024
55 checks passed
lrknox pushed a commit to lrknox/hdf5 that referenced this pull request Aug 21, 2024
@mattjala @lrknox
Fix segfault in ROS3 credential parsing (HDFGroup#4736)
51f6aac 
* Fix segfault in s3 credential parsing

* Fix AWS cred parsing when >1 profile provided
lrknox added a commit that referenced this pull request Aug 22, 2024
@lrknox
Sync develop changes July 29 - August 21 to hdf5_1_14. (#4742)
13a9a82 
* Warning fix (#4682)

* warning fix

* warning fix

* CMake link line needs to use new HDF5_ENABLE_THREADS (#4685)

* Correct the properties for using THREADS library (#4690)

* Bump the github-actions group with 5 updates (#4688)

Bumps the github-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.7` | `4.1.8` |
| [DoozyX/clang-format-lint-action](https://github.com/doozyx/clang-format-lint-action) | `0.13` | `0.17` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.0.6` | `2.0.8` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.3` | `2.4.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.25.11` | `3.25.15` |


Updates `actions/download-artifact` from 4.1.7 to 4.1.8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@65a9edc...fa0a91b)

Updates `DoozyX/clang-format-lint-action` from 0.13 to 0.17
- [Release notes](https://github.com/doozyx/clang-format-lint-action/releases)
- [Commits](DoozyX/clang-format-lint-action@v0.13...v0.17)

Updates `softprops/action-gh-release` from 2.0.6 to 2.0.8
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@a74c6b7...c062e08)

Updates `ossf/scorecard-action` from 2.3.3 to 2.4.0
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@dc50aa9...62b2cac)

Updates `github/codeql-action` from 3.25.11 to 3.25.15
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b611370...afb54ba)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: DoozyX/clang-format-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

* Fix segfault when closing datatype during failure in H5Topen2 (#4683)

* Rework Dynamic Analysis and sanitize testing (#4681)

* Ignore predetermined failing test and check pointer before use

* Rework Analysis process

* Remove another H5E_BEGIN/END_TRY within the library (#4675)

* Update logic for (deprecated) H5Gget_objinfo() call to eliminate H5E_BEGIN_TRY

* Handle case for '.' at the end of a path

* Drop H5E_BEGIN/END_TRY and just check the error return from H5I_clear_types() (#4694)

Original case that the change in commit 2dc738a
no longer applies.

* Add check of returned value from API calls. (#4702)

These were found while investigating GH-4672, but they were not related
to GH-4672.

* Add mac dmg binary and remove old macos-13 workflows (#4699)

* Add Windows SHLWAPI lib to public interface (#4701)

* Use local variable in btree2 and print value (#4679)

* Correct logic

* Technically, level 1 Express could skip tests

* Add windows signing (#4703)

* Add tests for H5R get name APIs (#4657)

Added functionality tests for the following APIs:
H5Rget_file_name
H5Rget_obj_name
H5Rget_attr_name

Also removed "+1" when returning a name length in H5R__get_attr_name().
The exter "+1" gave an incorrect value for the length of the referenced
object's attribute name.

Fixed GH-4447

* Fix Fortran test

The C API H5Rget_attr_name incorrectly added 1 to the length of the
referenced object's attribute name, so the Fortran API h5rget_attr_name_f
removed 1 from the returned value to accommodate the incorrectness.
This PR fixes H5Rget_attr_name so this workaround in h5rget_attr_name_f
is no longer needed.

* Add test H5Aget_name against H5Rget_attr_name

* Replace Visual Studio ???? with 2022 in MSI README file (#4709)

* Change logic for checking secrets exists (#4711)

* Change osx refs to macos (#4707)

* Replace alias \Code with \TText (#4714)

Fixed GH-2151

* Correct signing names and variables (#4713)

* Add secrets to release workflow (#4719)

* Add missing blosc2 info (#4717)

* Fix error return types in H5Rdeprec.c (#4722)

Copy-pasted code from elsewhere used FAIL instead of H5G_UNKNOWN
and H5I_INVALID_HID.

* Fix the release reference name (#4721)

* Test creating unseekable file (#4720)

* Cleanup up tests (#4724)

* Add arch name to dmg file name (#4732)

The binaries in snapshot dmg file do not work on x86_64.

* Fix snapshot CI failure by adding arch name to dmg file (#4734)

See also #4732.

* Fix incorrect VOL vs. non-VOL calls partially (#4733)

* Fix incorrect VOL vs. non-VOL calls

H5Lget_info2() called H5I_object() instead of H5VL_vol_object() crashed
user application.
This is a wide-spread issue (GH-4730) but this PR only addresses GH-4705.

* Remove an incorrect change

* Fix segfault in ROS3 credential parsing (#4736)

* Fix segfault in s3 credential parsing

* Fix AWS cred parsing when >1 profile provided

* Revert gh-pages action hash to fix daily build (#4735)

* Revert gh-pages action hash to fix daily build

See also #4734

* Revert gh-pages action hash to fix daily build

* Eliminate another use of H5E_clear_stack() within the library (#4726)

* Remove call to H5E_clear_stack()

Also clean up a bunch of error macros and the return value from H5B_valid()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jhendersonHDF jhendersonHDF jhendersonHDF left review comments

@hyoklee hyoklee hyoklee approved these changes

@qkoziol qkoziol qkoziol approved these changes

@lrknox lrknox Awaiting requested review from lrknox lrknox is a code owner

@derobins derobins Awaiting requested review from derobins derobins is a code owner

@byrnHDF byrnHDF Awaiting requested review from byrnHDF byrnHDF is a code owner

@fortnern fortnern Awaiting requested review from fortnern fortnern is a code owner

@vchoi-hdfgroup vchoi-hdfgroup Awaiting requested review from vchoi-hdfgroup vchoi-hdfgroup is a code owner

@bmribler bmribler Awaiting requested review from bmribler bmribler is a code owner

@glennsong09 glennsong09 Awaiting requested review from glennsong09 glennsong09 is a code owner

@brtnfld brtnfld Awaiting requested review from brtnfld brtnfld is a code owner

Assignees

@mattjala mattjala

Labels
Component - C Library Core C library issues (usually in the src directory) Merge - To 1.14 This needs to be merged to HDF5 1.14 Priority - 2. Medium ⏹ It would be nice to have this in the next release Type - Improvement Improvements that don't add a new feature or functionality
Projects
Downstream HDF5 Merges
Status: Needs Merged
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@mattjala @hyoklee @qkoziol @jhendersonHDF @lrknox