h5ls: SIGSEGV in Nbit filter processing when dumping datasets
- Dominant language
- C
- Stars
- 988
- Forks
- 355
- Avg merge
- 4d 2h
- Merged PRs (30d)
- 12
Description
**Describe the bug**
Running `h5ls -d` on crafted HDF5 files causes segmentation faults in the Nbit filter processing path. Two related PoC inputs trigger crashes in the same Nbit filter/chunk-read workflow: 1. One input reaches `H5Z__nbit_decompress_one_byte()` through `H5Z__nbit_decompress_one_atomic()` and `H5Z__filter_nbit()`, causing a SIGSEGV during Nbit decompression. 2. Another input crashes directly in `H5Z__filter_nbit()` with malformed filter parameters, including `cd_values=0x0`. Both crashes occur while `h5ls` is dumping dataset values through `H5Dread()` and `h5tools_dump_simple_dset()`.
**Steps to Reproduce:**
PoC inputs:
[Heap_Cprruption_1.zip](https://github.com/user-attachments/files/29442360/Heap_Cprruption_1.zip)
[Null_Pointer.zip](https://github.com/user-attachments/files/29442361/Null_Pointer.zip)
Command lines:
./h5ls -d Heap_Corruption_1
./h5ls -d Null_Pointer
**Expected behavior**
h5ls should exit cleanly with an error message, rather than crashing with SIGSEGV during filter processing or decompression.
**Platform (please complete the following information)**
- HDF5 version:
- Git branch: develop
- Commit: 8a2fb79
- OS and version:
- Ubuntu 22.04.5 LTS
- Compiler and version:
- clang: Ubuntu clang version 14.0.0-1ubuntu1.1
- gcc: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0
- Build system and generator:
- CMake 4.3.2
- Generator: Unix Makefiles, if you used the default CMake generator
- Configure options:
- Not explicitly recorded in this run.
- If same as the previous report:
`-DHDF5_BUILD_TOOLS=ON -DHDF5_BUILD_EXAMPLES=OFF -DHDF5_BUILD_TESTING=OFF -DHDF5_BUILD_HL_LIB=ON -DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON -DCMAKE_BUILD_TYPE=RelWithDebInfo`
- MPI library and version:
- Parallel HDF5 not enabled; no MPI library used.
**Additional context**
GDB output excerpt for the first PoC:
Program received signal SIGSEGV, Segmentation fault.
#0 0x00000000009bf327 in H5Z__nbit_decompress_one_byte (
data=0x7342aaae9010 "\200U\325\001\200U\345\001",
data_offset=356736,
k=3,
begin_i=3,
end_i=0,
buffer=0x44560910 ":\252\263ʫ>",
j=0x7fffbf95f320,
buf_len=0x7fffbf95f340,
p=0x7fffbf95f2c0,
datatype_len=)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Znbit.c:1012
#1 H5Z__nbit_decompress_one_atomic (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Znbit.c:1100
#2 0x00000000009bcdfa in H5Z__nbit_decompress (
data=0x1dbf319 "",
buffer=0x1e ,
parms=,
d_nelmts=)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Znbit.c:1291
#3 H5Z__filter_nbit (
flags=flags@entry=257,
cd_nelmts=cd_nelmts@entry=140736407663552,
cd_values=cd_values@entry=0x44555350,
nbytes=nbytes@entry=31,
buf_size=0x7fffbf95f520,
buf=0x7fffbf95f5b0)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Znbit.c:956
#4 0x00000000009b9408 in H5Z_pipeline (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Z.c:1451
#5 0x0000000000a1c2c9 in H5D__chunk_lock (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:4855
#6 0x0000000000a0d282 in H5D__chunk_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:3177
#7 0x00000000004ff290 in H5D__read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dio.c:398
#12 H5Dread (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5D.c:1049
#13 0x0000000000453f8f in h5tools_dump_simple_dset (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/lib/h5tools_dump.c:1747
#15 0x00000000004331bf in dump_dataset_values (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:1544
GDB output excerpt for the second PoC:
Program received signal SIGSEGV, Segmentation fault.
#0 H5Z__filter_nbit (
flags=flags@entry=2305,
cd_nelmts=0,
cd_nelmts@entry=140732496856640,
cd_values=cd_values@entry=0x0,
nbytes=nbytes@entry=31,
buf_size=0x7ffed67bc7a0,
buf=0x7ffed67bc830)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Znbit.c:935
#1 0x00000000009b9408 in H5Z_pipeline (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Z.c:1451
#2 0x0000000000a1c2c9 in H5D__chunk_lock (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:4855
#3 0x0000000000a0d282 in H5D__chunk_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:3177
#4 0x00000000004ff290 in H5D__read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dio.c:398
#9 H5Dread (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5D.c:1049
#10 0x0000000000453f8f in h5tools_dump_simple_dset (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/lib/h5tools_dump.c:1747
#12 0x00000000004331bf in dump_dataset_values (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:1544
#13 dataset_list2 (
name=name@entry=0x18b841e0 "/Nbit_float_data_le")
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:2140
#15 0x000000000046aca5 in traverse_cb (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/lib/h5trav.c:211
Contributor guide
Assessment
This issue has not been assessed yet.