HDFGroup / HDFGroup/hdf5

h5ls: SIGSEGV in H5_checksum_fletcher32 due to underflowed checksum length

Open
#6,490 0 comments 0 reactions 1 assignee Claimed by @mattjala View on GitHub
Dominant language
C
Stars
988
Forks
355
Avg merge
4d 2h
Merged PRs (30d)
12

Description

**Describe the bug**
Running `h5ls -d` on a HDF5 file causes a segmentation fault in `H5_checksum_fletcher32()` while reading a dataset with a malformed Fletcher32 filter. The crash occurs with `_len=18446744073709551612`, which indicates an underflowed length value being passed into the Fletcher32 checksum routine. The stack reaches the checksum function through `H5Z__filter_fletcher32()`, `H5Z_pipeline()`, and the chunk read path.

**Steps to Reproduce:**

PoC input:

[Heap_Corruption_2.zip](https://github.com/user-attachments/files/29442380/Heap_Corruption_2.zip)

Command line:

./h5ls -d Heap_Corruption_2

**Expected behavior**
h5ls should exit cleanly with an error message, rather than passing an underflowed length to H5_checksum_fletcher32() and crashing with SIGSEGV.

**Platform (please complete the following information)**

- HDF5 version:

- Git branch: develop

- Commit: 8a2fb79

- OS and version:

- Ubuntu 22.04.5 LTS

- Compiler and version:

- clang: Ubuntu clang version 14.0.0-1ubuntu1.1

- gcc: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

- Build system and generator:

- CMake 4.3.2

- Generator: Unix Makefiles, if you used the default CMake generator

- Configure options:

- Not explicitly recorded in this run.

- If same as the previous report:

`-DHDF5_BUILD_TOOLS=ON -DHDF5_BUILD_EXAMPLES=OFF -DHDF5_BUILD_TESTING=OFF -DHDF5_BUILD_HL_LIB=ON -DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON -DCMAKE_BUILD_TYPE=RelWithDebInfo`

- MPI library and version:

- Parallel HDF5 not enabled; no MPI library used.

**Additional context**
GDB output excerpt:

Program received signal SIGSEGV, Segmentation fault.

#0 H5_checksum_fletcher32 (
_data=_data@entry=0x34592d80,
_len=_len@entry=18446744073709551612)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5checksum.c:115
#1 0x00000000009bb4f3 in H5Z__filter_fletcher32 (
flags=flags@entry=256,
cd_nelmts=cd_nelmts@entry=140723566342976,
cd_values=cd_values@entry=0x0,
nbytes=nbytes@entry=0,
buf_size=0x7ffcc22ef4a0,
buf=)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Zfletcher32.c:78
#2 0x00000000009b9408 in H5Z_pipeline (
pline=pline@entry=0x345908c0,
flags=flags@entry=256,
filter_mask=filter_mask@entry=0x7ffcc22efca0,
edc_read=,
nbytes=0x7ffcc22ef4c0,
buf_size=0x7ffcc22ef4a0,
buf=0x7ffcc22ef530)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Z.c:1451
#3 0x0000000000a1c2c9 in H5D__chunk_lock (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:4855
#4 0x0000000000a0d282 in H5D__chunk_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:3177
#5 0x00000000004ff290 in H5D__read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dio.c:398
#6 0x00000000009a44c6 in H5VL__native_dataset_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5VLnative_dataset.c:373
#10 H5Dread (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5D.c:1049
#11 0x0000000000453f8f in h5tools_dump_simple_dset (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/lib/h5tools_dump.c:1747
#13 0x00000000004331bf in dump_dataset_values (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:1544
#14 dataset_list2 (
name=name@entry=0x34595510 "/Fletcher_float_data_be")
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:2140
#15 0x0000000000439845 in list_obj (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5ls/h5ls.c:2337

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.