漏洞概述 在GDAL的vendored HDF-EOS库中，通过 中的 函数存在一个越界读取漏洞。该漏洞发生在处理 元数据值时，由于未正确检查字符串长度，导致 操作可能读取超出缓冲区边界的数据，从而引发崩溃。 影响范围 版本：GDAL 3.13.0dev-4681ad376 提交：4681ad376 影响：立即导致拒绝服务（DoS） 修复方案 修复方案未在页面中明确提及，但根据漏洞描述，需要在 中的 函数中增加对字符串长度的正确检查，避免 操作读取超出缓冲区边界的数据。 POC代码 ASAN输出 ```plaintext ==58665==ERROR: AddressSanitizer: unknown-crash on address 0x6f43940e6481 at pc 0x7f2f39e03a260 bp 0x7fffd900d5c0 sp 0x7fffd900d5c0 READ of size 184674487789535514 at 0x6f43940e6481 thread T0 #0 0x7f2f39e03a264 in memmove /usr/include/aarch64-linux-gnu/bits/string_fortified.h:36 #1 0x7f2f39e03a264 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1384 #2 0x7f2f39e03b990 in SwiInfoInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1479 #3 0x7f2f39e03c15c in HDF4SwathSubGroup::OpenMDArray(...) const /home/roo/Desktop/gdal/gdal/frmts/hdf4/ #4 0x7f2f39104cc0 in DumpArrays /home/roo/Desktop/gdal/gdal/apps/gdalinfoinfo_lib.cpp:1982 #5 0x7f2f39104c00 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfoinfo_lib.cpp:1151 #6 0x7f2f39103744 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfoinfo_lib.cpp:1175 #7 0x7f2f39103744 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfoinfo_lib.cpp:1175 #8 0x7f2f39103f44 in GDALMultiDimInfo /home/roo/Desktop/gdal/gdal/apps/gdalinfoinfo_lib.cpp:1360 #9 0x7f2f39106eac in GDALInfo /home/roo/Desktop/gdal/gdal/apps/gdalinfoinfo_bin.cpp:83 #10 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #11 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #12 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #13 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #14 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #15 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #16 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #17 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #18 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #19 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #20 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #21 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #22 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #23 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #24 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #25 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #26 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #27 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #28 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #29 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #30 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #31 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #32 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #33 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #34 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #35 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #36 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #37 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #38 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #39 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #40 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #41 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #42 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #43 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #44 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #45 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #46 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #47 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #48 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #49 0x7f2f39e03818 in SwiInfo /home/roo/Desktop/gdal/gdal/frmts/hdf4/hdf-eos/SWapi.c:1228 #50 0x7f2f39e03818 in S