mirrors/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2026-09-25 04:09:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

Validate VL datatype type during decode and check file pointer in H5T_set_loc (#6395)

Browse Source 
H5O__dtype_decode_helper() reads vlen.type from the file without
validation. With corrupted HDF5 files (e.g. from fuzzing), this field
can have an invalid value that is neither H5T_VLEN_SEQUENCE nor
H5T_VLEN_STRING, which later triggers assert(0) in H5T__vlen_set_loc()
(debug builds) or a NULL pointer dereference / SEGV in release builds.

Fix by:
1. Adding a validation check in H5O__dtype_decode_helper() immediately
   after reading the vlen.type field, returning an error if the value
   is invalid.
2. Adding a NULL file pointer check in H5T_set_loc() before calling
   H5T__vlen_set_loc() when loc == H5T_LOC_DISK, so the low-level
   assert(file) invariant is never violated.

This fixes the root cause at the decode level where the bad value
enters the system, as requested in review of #6378 and #6385.

Found by OSS-Fuzz via the matio fuzzer (ClusterFuzz testcase
5366895365914624).
This commit is contained in:
tbeu
2026-05-28 10:26:57 -05:00
committed by GitHub
parent 00af022f1e
commit 3fa6ed6e9d
2 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/H5Odtype.c
+2
View File
@@ -760,6 +760,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
*/
/* Set the type of VL information, either sequence or string */
dt->shared->u.vlen.type = (H5T_vlen_type_t)(flags & 0x0f);
if (dt->shared->u.vlen.type != H5T_VLEN_SEQUENCE && dt->shared->u.vlen.type != H5T_VLEN_STRING)
HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, "invalid VL datatype type");
if (dt->shared->u.vlen.type == H5T_VLEN_STRING) {
dt->shared->u.vlen.pad = (H5T_str_t)((flags >> 4) & 0x0f);
dt->shared->u.vlen.cset = (H5T_cset_t)((flags >> 8) & 0x0f);
src/H5T.c
+5
View File
@@ -7014,6 +7014,11 @@ H5T_set_loc(H5T_t *dt, H5VL_object_t *file, H5T_loc_t loc)
ret_value = changed;
} /* end if */
/* Validate file pointer for disk-based VL types */
if (loc == H5T_LOC_DISK && NULL == file)
HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL,
"NULL file pointer for disk-based VL datatype");
/* Mark this VL sequence */
if ((changed = H5T__vlen_set_loc(dt, file, loc)) < 0)
HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "Unable to set VL location");