h5ls: SIGSEGV in H5_checksum_fletcher32 due to underflowed checksum length
- Dominant language
- C
- Stars
- 988
- Forks
- 355
- Avg merge
- 4d 2h
- Merged PRs (30d)
- 12
Description
**Describe the bug**
Running `h5ls -d` on a HDF5 file causes a segmentation fault in `H5_checksum_fletcher32()` while reading a dataset with a malformed Fletcher32 filter. The crash occurs with `_len=18446744073709551612`, which indicates an underflowed length value being passed into the Fletcher32 checksum routine. The stack reaches the checksum function through `H5Z__filter_fletcher32()`, `H5Z_pipeline()`, and the chunk read path.
**Steps to Reproduce:**
PoC input:
[Heap_Corruption_2.zip](https://github.com/user-attachments/files/29442380/Heap_Corruption_2.zip)
Command line:
./h5ls -d Heap_Corruption_2
**Expected behavior**
h5ls should exit cleanly with an error message, rather than passing an underflowed length to H5_checksum_fletcher32() and crashing with SIGSEGV.
**Platform (please complete the following information)**
- HDF5 version:
- Git branch: develop
- Commit: 8a2fb79
- OS and version:
- Ubuntu 22.04.5 LTS
- Compiler and version:
- clang: Ubuntu clang version 14.0.0-1ubuntu1.1
- gcc: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0
- Build system and generator:
- CMake 4.3.2
- Generator: Unix Makefiles, if you used the default CMake generator
- Configure options:
- Not explicitly recorded in this run.
- If same as the previous report:
`-DHDF5_BUILD_TOOLS=ON -DHDF5_BUILD_EXAMPLES=OFF -DHDF5_BUILD_TESTING=OFF -DHDF5_BUILD_HL_LIB=ON -DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON -DCMAKE_BUILD_TYPE=RelWithDebInfo`
- MPI library and version:
- Parallel HDF5 not enabled; no MPI library used.
**Additional context**
GDB output excerpt:
Program received signal SIGSEGV, Segmentation fault.
#0 H5_checksum_fletcher32 (
_data=_data@entry=0x34592d80,
_len=_len@entry=18446744073709551612)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5checksum.c:115
#1 0x00000000009bb4f3 in H5Z__filter_fletcher32 (
flags=flags@entry=256,
cd_nelmts=cd_nelmts@entry=140723566342976,
cd_values=cd_values@entry=0x0,
nbytes=nbytes@entry=0,
buf_size=0x7ffcc22ef4a0,
buf=)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Zfletcher32.c:78
#2 0x00000000009b9408 in H5Z_pipeline (
pline=pline@entry=0x345908c0,
flags=flags@entry=256,
filter_mask=filter_mask@entry=0x7ffcc22efca0,
edc_read=,
nbytes=0x7ffcc22ef4c0,
buf_size=0x7ffcc22ef4a0,
buf=0x7ffcc22ef530)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Z.c:1451
#3 0x0000000000a1c2c9 in H5D__chunk_lock (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:4855
#4 0x0000000000a0d282 in H5D__chunk_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:3177
#5 0x00000000004ff290 in H5D__read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dio.c:398
#6 0x00000000009a44c6 in H5VL__native_dataset_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5VLnative_dataset.c:373
#10 H5Dread (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5D.c:1049
#11 0x0000000000453f8f in h5tools_dump_simple_dset (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/lib/h5tools_dump.c:1747
#13 0x00000000004331bf in dump_dataset_values (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:1544
#14 dataset_list2 (
name=name@entry=0x34595510 "/Fletcher_float_data_be")
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:2140
#15 0x0000000000439845 in list_obj (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:2337
Contributor guide
Assessment
This issue has not been assessed yet.