SEGV in get_attached_info netcdf/libhdf5/hdf5open.c

[cniddodi]

SEGV in get_attached_info netcdf/libhdf5/hdf5open.c

Built from git commit hash 63150df
OS: Ubuntu 20.04
Compiler: clang version 11.0

Build options:

• Shared library disabled
  CC=clang
  CXX=clang++
  CFLAGS="-g -fno-inline -fsanitize=address"
  CXXFLAGS="-g -fno-inline -fsanitize=address"
  LDFLAGS="$LDFLAGS -fsanitize=address"
  ASAN_OPTIONS=abort_on_error=1

Command: ./ncdump pov

POV file:
pov.zip

Stack trace:

==3258776==ERROR: AddressSanitizer: SEGV on unknown address 0x62030000f2e0 (pc 0x7f0f55577580 bp 0x607000000480 sp 0x7fffa17ae3d0 T0)
==3258776==The signal is caused by a READ memory access.
#0 0x7f0f55577580  (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x153580)
#1 0x7f0f5549f775 in H5C_protect (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x7b775)
#2 0x7f0f55479eea in H5AC_protect (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x55eea)
#3 0x7f0f55575372 in H5HG__protect (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x151372)
#4 0x7f0f5557587a in H5HG_read (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x15187a)
#5 0x7f0f556bce3f  (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x298e3f)
#6 0x7f0f5565b577 in H5T__conv_vlen (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x237577)
#7 0x7f0f5564f91f in H5T_convert (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x22b91f)
#8 0x7f0f55471e30 in H5A__read (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x4de30)
#9 0x7f0f554683a9 in H5Aread (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x443a9)
#10 0x7f0f557ac08f in H5DSget_num_scales (/lib/x86_64-linux-gnu/libhdf5_serial_hl.so.100+0xb08f)
#11 0x64777d in get_attached_info netcdf/libhdf5/hdf5open.c:1333:18
#12 0x645d6b in nc4_get_var_meta netcdf/libhdf5/hdf5open.c:1492:23
#13 0x642db5 in nc4_hdf5_find_grp_var_att netcdf/libhdf5/hdf5internal.c:924:27
#14 0x668690 in NC4_HDF5_inq_var_all netcdf/libhdf5/hdf5var.c:2320:19
#15 0x569db4 in nc_inq_var netcdf/libdispatch/dvarinq.c:131:11
#16 0x569ef7 in nc_inq_varndims netcdf/libdispatch/dvarinq.c:204:11
#17 0x50128b in do_ncdump_rec netcdf/ncdump/ncdump.c:1762:7
#18 0x4fda26 in do_ncdump netcdf/ncdump/ncdump.c:2047:4
#19 0x4fb3b2 in main netcdf/ncdump/ncdump.c:2490:7
#20 0x7f0f54e35082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#21 0x41fe2d in _start (netcdf/ncdump/ncdump+0x41fe2d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x153580)
==3258776==ABORTING

[captainkirk99]

This issue is fixed in the current codebase. The root cause was in get_attached_info() in libhdf5/hdf5open.c.

The bug: The buffers dimscale_attached and dimscale_hdf5_objids were allocated using the ndims parameter (derived from H5Sget_simple_extent_ndims() on the actual HDF5 dataspace), but the iteration loop used var->ndims as the loop bound:

for (unsigned int d = 0; d < var->ndims; d++)

A corrupt/crafted HDF5 file could cause var->ndims to differ from ndims, making the loop overrun both allocated buffers. The subsequent H5DSiterate_scales() call on a later iteration then crashed with a SEGV as it encountered corrupted HDF5 internal state (manifesting inside H5DSget_num_scales / H5T__conv_vlen / H5HG_read).

The fix (already applied):

1. Added a guard that returns NC_EVARMETA immediately if ndims != var->ndims, catching the corrupt-file condition before any allocation.
2. Changed the loop bound from var->ndims to ndims so it stays within the allocated buffer bounds.

This can be closed.

[WardF]

Closing as complete, thanks!