Fix segfault in H5S__get_select_hyper_blocklist() (#5353)

release_docs/RELEASE.txt

@@ -530,6 +530,15 @@ Bug Fixes since HDF5-2.0.0 release
       the dataspace has an extent with a rank value of 0. This has been fixed
       by converting the assertion failure into a normal error check.
 
+    - Fixed a segfault in H5S__get_select_hyper_blocklist()
+
+      When attempting to retrieve the list of hyperslab blocks selected
+      within a dataspace, a segfault or bus error could occur when the
+      dataspace has an extent with a rank value of 0. This would cause
+      indexing into an array variable on the stack using a negative
+      value. An error check was added to return failure from the function
+      for such dataspaces.
+
     - Fixed an error in H5Ddebug
 
       H5Ddebug would fail for any chunked dataset with a chunk index, due to its

src/H5Shyper.c

@@ -3297,6 +3297,14 @@ H5S__hyper_is_valid(const H5S_t *space)
 
     assert(space);
 
+    /* Check if dataspace has scalar or null extent, which are
+     * both unsupported by hyperslab selections
+     */
+    if (H5S_SCALAR == H5S_GET_EXTENT_TYPE(space))
+        HGOTO_DONE(false);
+    if (H5S_NULL == H5S_GET_EXTENT_TYPE(space))
+        HGOTO_DONE(false);
+
     /* Check for unlimited selection */
     if (space->select.sel_info.hslab->unlim_dim >= 0)
         HGOTO_DONE(false);
@@ -4652,12 +4660,16 @@ H5S__get_select_hyper_blocklist(H5S_t *space, hsize_t startblock, hsize_t numblo
 {
     herr_t ret_value = SUCCEED; /* Return value */
 
-    FUNC_ENTER_PACKAGE_NOERR
+    FUNC_ENTER_PACKAGE
 
     assert(space);
     assert(buf);
     assert(space->select.sel_info.hslab->unlim_dim < 0);
 
+    if (space->extent.rank == 0)
+        HGOTO_ERROR(H5E_DATASPACE, H5E_BADVALUE, FAIL,
+                    "dataspace has invalid extent for hyperslab selection");
+
     /* Attempt to rebuild diminfo if it is invalid and has not been confirmed
      * to be impossible.
      */
@@ -4795,6 +4807,7 @@ H5S__get_select_hyper_blocklist(H5S_t *space, hsize_t startblock, hsize_t numblo
                                               &startblock, &numblocks, &buf);
     } /* end else */
 
+done:
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5S__get_select_hyper_blocklist() */
 

test/th5s.c

@@ -3393,6 +3393,46 @@ test_h5s_bug3(void)
     CHECK(ret, FAIL, "H5Sclose");
 } /* test_h5s_bug3() */
 
+/****************************************************************
+**
+**  test_h5s_bug5(): Test a bug where calling the function
+**                   H5Sget_select_hyper_blocklist() on a
+**                   dataspace that has an extent with a rank of
+**                   0 would cause an over-read of a stack array
+**                   variable due to indexing by "ndims - 1".
+**
+****************************************************************/
+static void
+test_h5s_bug5(void)
+{
+    hsize_t dims[]  = {10};
+    hsize_t start[] = {0};
+    hsize_t count[] = {1};
+    hsize_t blocks[1];
+    herr_t  ret      = SUCCEED;
+    hid_t   space_id = H5I_INVALID_HID;
+
+    space_id = H5Screate_simple(1, dims, NULL);
+    CHECK(space_id, H5I_INVALID_HID, "H5Screate_simple");
+
+    ret = H5Sselect_hyperslab(space_id, H5S_SELECT_SET, start, NULL, count, NULL);
+    CHECK(ret, FAIL, "H5Sselect_hyperslab");
+
+    ret = H5Sset_extent_none(space_id);
+    CHECK(ret, FAIL, "H5Sset_extent_none");
+
+    /* Hyperslab selections are unsupported for scalar and null extents */
+    H5E_BEGIN_TRY
+    {
+        ret = H5Sget_select_hyper_blocklist(space_id, 0, 1, blocks);
+    }
+    H5E_END_TRY
+    VERIFY(ret, FAIL, "H5Sget_select_hyper_blocklist");
+
+    ret = H5Sclose(space_id);
+    CHECK(ret, FAIL, "H5Sclose");
+} /* test_h5s_bug5() */
+
 /****************************************************************
 **
 **  test_h5s_bug6(): Test calling H5Sselect_hyperslab() on a
@@ -3668,6 +3708,7 @@ test_h5s(void H5_ATTR_UNUSED *params)
     test_h5s_bug1();         /* Test bug in offset initialization */
     test_h5s_bug2();         /* Test bug found in H5S__hyper_update_diminfo() */
     test_h5s_bug3();         /* Test bug found in H5S__combine_select() */
+    test_h5s_bug5();         /* Test bug found in H5S__get_select_hyper_blocklist() */
     test_h5s_bug6();         /* Test bug found in H5S__hyper_make_spans() */
     test_h5s_bug7();         /* Test bug found in H5S__hyper_new_span_info() */
     test_versionbounds();    /* Test version bounds with dataspace */