h5dump: SIGSEGV in H5_checksum_fletcher32 due to underflowed checksum length
- Dominant language
- C
- Stars
- 988
- Forks
- 355
- Avg merge
- 4d 2h
- Merged PRs (30d)
- 12
Description
**Describe the bug**
Running `h5dump` on a HDF5 file causes a segmentation fault in `H5_checksum_fletcher32()` while reading a chunked dataset with a Fletcher32 filter.
The crash occurs with `_len=18446744073709551612`, which indicates an underflowed length value being passed into the Fletcher32 checksum routine. The stack reaches the checksum function through `H5Z__filter_fletcher32()`, `H5Z_pipeline()`, and the chunk read path.
**Steps to Reproduce:**
The PoC input file is:
[Heap_Corruption.zip](https://github.com/user-attachments/files/29442261/Heap_Corruption.zip)
Command line:
./h5dump Heap_Corruption
**Expected behavior**
h5dump should exit cleanly with an error message, rather than passing an underflowed length to H5_checksum_fletcher32() and crashing.
**Platform (please complete the following information)**
- HDF5 version:
- Git branch: develop
- Commit: 8a2fb79
- OS and version:
- Ubuntu 22.04.5 LTS
- Compiler and version:
- clang: Ubuntu clang version 14.0.0-1ubuntu1.1
- gcc: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0
- Build system and generator:
- CMake 4.3.2
- Generator: Unix Makefiles, if you used the default CMake generator
- Configure options:
- Not explicitly recorded in this run.
- If same as the previous report:
`-DHDF5_BUILD_TOOLS=ON -DHDF5_BUILD_EXAMPLES=OFF -DHDF5_BUILD_TESTING=OFF -DHDF5_BUILD_HL_LIB=ON -DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON -DCMAKE_BUILD_TYPE=RelWithDebInfo`
- MPI library and version:
- Parallel HDF5 not enabled; no MPI library used.
**Additional context**
GDB output excerpt:
Program received signal SIGSEGV, Segmentation fault.
#0 H5_checksum_fletcher32 (
_data=_data@entry=0x1c773590,
_len=_len@entry=18446744073709551612)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5checksum.c:115
#1 0x00000000009d8773 in H5Z__filter_fletcher32 (
flags=flags@entry=256,
cd_nelmts=cd_nelmts@entry=140736624700192,
cd_values=cd_values@entry=0x0,
nbytes=nbytes@entry=0,
buf_size=0x7fffcc85ac80,
buf=)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Zfletcher32.c:78
#2 0x00000000009d6688 in H5Z_pipeline (
pline=pline@entry=0x1c71e550,
flags=flags@entry=256,
filter_mask=filter_mask@entry=0x7fffcc85b480,
edc_read=,
nbytes=0x7fffcc85aca0,
buf_size=0x7fffcc85ac80,
buf=0x7fffcc85ad10)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Z.c:1451
#3 0x0000000000a37c39 in H5D__chunk_lock (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:4855
#4 0x0000000000a28bf2 in H5D__chunk_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:3177
#5 0x0000000000515270 in H5D__read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dio.c:398
#6 0x00000000009c1746 in H5VL__native_dataset_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5VLnative_dataset.c:373
#10 H5Dread (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5D.c:1049
#11 0x000000000046898f in h5tools_dump_simple_dset (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/lib/h5tools_dump.c:1747
#14 0x0000000000438b47 in dump_dataset (
name=name@entry=0x1c7578c0 "Fletcher_float_data_le",
sset=sset@entry=0x0)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5dump/h5dump_ddl.c:1087
Contributor guide
Assessment
This issue has not been assessed yet.