Files
b7b85e7abf Fix CVE-2026-19025 (Reject chunked datasets with mismatched chunk/dspace rank at open time) (#6508)
* Reject chunked datasets with mismatched chunk/dspace rank

H5D__chunk_construct() validates that the chunk layout dimensionality
matches the dataspace rank, but that runs only at dataset creation time.
When an existing dataset is opened, H5D__chunk_init() didn't repeat the
check, so a file whose stored chunk rank disagreed with its dataspace rank
was accepted. During chunk I/O the memory-selection rank (from the
dataspace) and the file-selection rank (chunk ndims - 1) then differ, which
produces a zero stride that causes a divide-by-zero in
H5S__hyper_iter_get_seq_list().

H5D__chunk_init() now performs the same dimensionality check on open (the
stored chunk rank includes the extra element-size dimension, so it must be
exactly one greater than the dataspace rank) and rejects a mismatch with an
error.

Added test_chunk_dims_mismatch() as a regression test in test/dsets.c

Fixes #6491

* Fix typo

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Clarify element-vs-byte wording

* Validate chunk/dataspace rank at layout decode time

Move the stored-chunk-rank vs dataspace-rank consistency check out of
H5D__chunk_init() and into H5O__layout_decode(), so a malformed chunked
layout is rejected as the message is decoded (mirroring the fill/datatype
size check in the fill message decode).

* Update release_docs/CHANGELOG.md

Co-authored-by: Larry Knox <lrknox@hdfgroup.org>

* Update CHANGELOG

* Pin format version bounds in bad chunk layout generator

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
2026-08-28 13:49:02 -05:00
..
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2024-10-03 12:19:33 -07:00
2019-08-12 15:38:15 -05:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00
2023-09-26 13:46:55 -07:00