heap-buffer-overflow at H5Faccum.c:570
- Dominant language
- C
- Stars
- 988
- Forks
- 355
- Avg merge
- 4d 2h
- Merged PRs (30d)
- 12
Description
Hi, I found a heap-buffer-overflow bug when testing HDF5 libraries with a fuzzing harness on `x86-64 Ubuntu 22.04`, and it is still reproducible on current commit (`3363183`).
#### Files:
[4.zip](https://github.com/user-attachments/files/22351651/4.zip)
#### Compiler:
```
Ubuntu clang version 14.0.0-1ubuntu1.1
```
#### Build commands:
```
export CC=clang
export CXX=clang++
cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE:STRING=Release -DBUILD_SHARED_LIBS:BOOL=OFF -DBUILD_TESTING:BOOL=ON -DHDF5_BUILD_TOOLS:BOOL=ON -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -O1 -g" -DCMAKE_CXX_FLAGS="-fsanitize=address -fno-omit-frame-pointer -O1 -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" -DCMAKE_SHARED_LINKER_FLAGS="-fsanitize=address" ..
cmake --build . --config Release
clang -o ./hdf5 ./hdf5.c -fsanitize=address -fno-omit-frame-pointer -O1 -g -I ../src/ -I ../src/H5FDsubfiling -I ./src -L ../src/.libs/ -L ./bin/ -l:libhdf5.a -lz -lm
```
#### Commandline:
```
./hdf5 ./4
```
#### Crash line:
```
" 566 /* Compute offset of dirty region (after adjusting accumulator) */",
" 567 dirty_off = (size_t)(addr - accum->loc);",
" 568 ",
" 569 /* Copy the new metadata to the end */",
"--->570 H5MM_memcpy(accum->buf + dirty_off, buf, size);",
" 571 ",
" 572 /* Set the new size of the metadata accumulator */",
" 573 accum->size += add_size;",
" 574 ",
" 575 /* Adjust the dirty region and mark accumulator dirty */"
```
#### Stacktrace:
```
" #0 0x5555557df7f9 in __asan_memcpy (hdf5+0x28b7f9) (BuildId: bba9551717dcc6a726bcb7141b7bc2e6ca666c47)",
" #1 0x555556062a42 in H5F__accum_write hdf_sep15/src/H5Faccum.c:570:25",
" #2 0x5555559f72ab in H5PB_write hdf_sep15/src/H5PB.c:1003:13",
" #3 0x55555584b692 in H5F_block_write hdf_sep15/src/H5Fio.c:218:9",
" #4 0x555555f36e19 in H5C__flush_single_entry hdf_sep15/src/H5Centry.c:597:21",
" #5 0x555555f5fde4 in H5C__make_space_in_cache hdf_sep15/src/H5Cint.c:1910:25",
" #6 0x555555f4454b in H5C_protect hdf_sep15/src/H5Centry.c:3189:17",
" #7 0x555555ee9080 in H5AC_protect hdf_sep15/src/H5AC.c:1302:26",
" #8 0x5555559098f1 in H5HL_protect hdf_sep15/src/H5HL.c:323:40",
" #9 0x555555903a0d in H5G__stab_lookup hdf_sep15/src/H5Gstab.c:811:25",
" #10 0x5555558fc6cc in H5G__obj_lookup hdf_sep15/src/H5Gobj.c:1086:13",
" #11 0x555555907064 in H5G__traverse_real hdf_sep15/src/H5Gtraverse.c:572:13",
" #12 0x555555906332 in H5G_traverse hdf_sep15/src/H5Gtraverse.c:845:9",
" #13 0x55555591e318 in H5L__create_real hdf_sep15/src/H5Lint.c:767:9",
" #14 0x55555591e699 in H5L_link_object hdf_sep15/src/H5Lint.c:521:9",
" #15 0x5555558dd482 in H5G__create_named hdf_sep15/src/H5Gint.c:317:9",
" #16 0x555555e8945f in H5VL__native_group_create hdf_sep15/src/H5VLnative_group.c:101:28",
" #17 0x555555e56170 in H5VL__group_create hdf_sep15/src/H5VLcallback.c:4430:17",
" #18 0x555555e55c8b in H5VL_group_create hdf_sep15/src/H5VLcallback.c:4465:30",
" #19 0x5555558c6bbd in H5G__create_api_common hdf_sep15/src/H5G.c:182:24",
" #20 0x5555558c6364 in H5Gcreate2 hdf_sep15/src/H5G.c:229:22",
" #21 0x55555581b383 in main hdf_sep15/asan_build/./hdf5.c:29:27",
```
Let me know if you need more information!
Contributor guide
Assessment
This issue has not been assessed yet.