memcpy-param-overlap in get_attached_info netcdf/libhdf5/hdf5open.c

[cniddodi]

memcpy-param-overlap in get_attached_info netcdf/libhdf5/hdf5open.c

Built from git commit hash 63150df
OS: Ubuntu 20.04
Compiler: clang version 11.0

Build options:

• Shared library disabled
  CC=clang
  CXX=clang++
  CFLAGS="-g -fno-inline -fsanitize=address"
  CXXFLAGS="-g -fno-inline -fsanitize=address"
  LDFLAGS="$LDFLAGS -fsanitize=address"
  ASAN_OPTIONS=abort_on_error=1

Command: ./ncdump pov

POV file:
pov.zip

Stack trace:

==3258744==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x62100000c908,0x62100003c910) and [0x62100000f1e8, 0x62100003f1f0) overlap
#0 0x43bc3e in __interceptor_memcpy.part.0 /home/chaitra/aflgo-top/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:808:5
#1 0x7f7df735d8cf in H5HG_read (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x1518cf)
#2 0x7f7df74a4e3f  (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x298e3f)
#3 0x7f7df7443577 in H5T__conv_vlen (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x237577)
#4 0x7f7df743791f in H5T_convert (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x22b91f)
#5 0x7f7df7259e30 in H5A__read (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x4de30)
#6 0x7f7df72503a9 in H5Aread (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x443a9)
#7 0x7f7df759408f in H5DSget_num_scales (/lib/x86_64-linux-gnu/libhdf5_serial_hl.so.100+0xb08f)
#8 0x64777d in get_attached_info netcdf/libhdf5/hdf5open.c:1333:18
#9 0x645d6b in nc4_get_var_meta netcdf/libhdf5/hdf5open.c:1492:23
#10 0x642db5 in nc4_hdf5_find_grp_var_att netcdf/libhdf5/hdf5internal.c:924:27
#11 0x668690 in NC4_HDF5_inq_var_all netcdf/libhdf5/hdf5var.c:2320:19
#12 0x569db4 in nc_inq_var netcdf/libdispatch/dvarinq.c:131:11
#13 0x569ef7 in nc_inq_varndims netcdf/libdispatch/dvarinq.c:204:11
#14 0x50128b in do_ncdump_rec netcdf/ncdump/ncdump.c:1762:7
#15 0x4fda26 in do_ncdump netcdf/ncdump/ncdump.c:2047:4
#16 0x4fb3b2 in main netcdf/ncdump/ncdump.c:2490:7
#17 0x7f7df6c1d082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#18 0x41fe2d in _start (netcdf/ncdump/ncdump+0x41fe2d)
0x62100000d908 is located 0 bytes to the right of 4104-byte region [0x62100000c900,0x62100000d908)
allocated by thread T0 here:
#0 0x4c4f4f in malloc /home/chaitra/aflgo-top/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
#1 0x7f7df7316641  (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x10a641)
0x621000010108 is located 0 bytes to the right of 4104-byte region [0x62100000f100,0x621000010108)
allocated by thread T0 here:
#0 0x4c4f4f in malloc /home/chaitra/aflgo-top/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
#1 0x7f7df7316641  (/lib/x86_64-linux-gnu/libhdf5_serial.so.103+0x10a641)
SUMMARY: AddressSanitizer: memcpy-param-overlap /home/chaitra/aflgo-top/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:808:5 in __interceptor_memcpy.part.0
==3258744==ABORTING

[captainkirk99]

This is the same bug as #2664 and #2666, already fixed in the current codebase.

The root cause was in get_attached_info() in libhdf5/hdf5open.c. The buffers dimscale_attached and dimscale_hdf5_objids were allocated using the ndims parameter (from H5Sget_simple_extent_ndims() on the HDF5 dataspace), but the iteration loop used var->ndims as its bound:

for (unsigned int d = 0; d < var->ndims; d++)

A corrupt/crafted HDF5 file could cause var->ndims to differ from ndims, making the loop overrun both allocated buffers. The heap corruption then manifested inside HDF5 internals as the memcpy-param-overlap reported here.

The fix (already applied) adds a guard returning NC_EVARMETA if ndims != var->ndims, and corrects the loop bound to use ndims rather than var->ndims. This was explicitly noted in the fix as addressing issues #2664, #2666, and #2667.

This can be closed.

[WardF]

Closing as complete, thanks!