heap-buffer-overflow in get_attached_info netcdf/libhdf5/hdf5open.c

[cniddodi]

heap-buffer-overflow in get_attached_info netcdf/libhdf5/hdf5open.c

Built from git commit hash 63150df
OS: Ubuntu 20.04
Compiler: clang version 11.0

Build options:

• Shared library disabled
  CC=clang
  CXX=clang++
  CFLAGS="-g -fno-inline -fsanitize=address"
  CXXFLAGS="-g -fno-inline -fsanitize=address"
  LDFLAGS="$LDFLAGS -fsanitize=address"
  ASAN_OPTIONS=abort_on_error=1

Command: ./ncdump pov

POV file:
pov.zip

Stack trace:

==3258750==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000010108 at pc 0x00000043bdad bp 0x7ffe1e236a90 sp 0x7ffe1e236240
READ of size 4104 at 0x621000010108 thread T0
#0 0x43bdac in __interceptor_memcpy.part.0 /home/chaitra/aflgo-top/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:808:5
#1 0x7f04b0df68cf in H5HG_read (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x1518cf)
#2 0x7f04b0f3de3f  (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x298e3f)
#3 0x7f04b0edc577 in H5T__conv_vlen (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x237577)
#4 0x7f04b0ed091f in H5T_convert (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x22b91f)
#5 0x7f04b0cf2e30 in H5A__read (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x4de30)
#6 0x7f04b0ce93a9 in H5Aread (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x443a9)
#7 0x7f04b102d08f in H5DSget_num_scales (/lib/x86_64-linux-gnu/libhdf5_serial_hl.so.100+0xb08f)
#8 0x64777d in get_attached_info netcdf/libhdf5/hdf5open.c:1333:18
#9 0x645d6b in nc4_get_var_meta netcdf/libhdf5/hdf5open.c:1492:23
#10 0x642db5 in nc4_hdf5_find_grp_var_att netcdf/libhdf5/hdf5internal.c:924:27
#11 0x668690 in NC4_HDF5_inq_var_all netcdf/libhdf5/hdf5var.c:2320:19
#12 0x569db4 in nc_inq_var netcdf/libdispatch/dvarinq.c:131:11
#13 0x569ef7 in nc_inq_varndims netcdf/libdispatch/dvarinq.c:204:11
#14 0x50128b in do_ncdump_rec netcdf/ncdump/ncdump.c:1762:7
#15 0x4fda26 in do_ncdump netcdf/ncdump/ncdump.c:2047:4
#16 0x4fb3b2 in main netcdf/ncdump/ncdump.c:2490:7
#17 0x7f04b06b6082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#18 0x41fe2d in _start (netcdf/ncdump/ncdump+0x41fe2d)
0x621000010108 is located 0 bytes to the right of 4104-byte region [0x62100000f100,0x621000010108)
allocated by thread T0 here:
#0 0x4c4f4f in malloc /home/chaitra/aflgo-top/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
#1 0x7f04b0daf641  (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x10a641)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/chaitra/aflgo-top/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:808:5 in __interceptor_memcpy.part.0
Shadow bytes around the buggy address:
0x0c427fff9fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fff9fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fff9ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffa010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffa020: 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==3258750==ABORTING

[captainkirk99]

This is the same bug as #2664, already fixed in the current codebase.

The root cause was in get_attached_info() in libhdf5/hdf5open.c. The buffers dimscale_attached and dimscale_hdf5_objids were allocated using the ndims parameter (from H5Sget_simple_extent_ndims() on the HDF5 dataspace), but the iteration loop used var->ndims as its bound:

for (unsigned int d = 0; d < var->ndims; d++)

A corrupt/crafted HDF5 file could cause var->ndims to differ from ndims, making the loop overrun both allocated buffers. The heap corruption then manifested inside HDF5 internals (H5DSget_num_scales / H5HG_read / memcpy) as the heap-buffer-overflow reported here.

The fix (already applied) adds a guard returning NC_EVARMETA if ndims != var->ndims, and corrects the loop bound to use ndims rather than var->ndims. This was explicitly noted in the fix as addressing issues #2664, #2666, and #2667.

This can be closed.

[WardF]

Closing as complete, thanks!