h5repack: SIGFPE in H5S__hyper_iter_get_seq_list when repacking dataset

[Nievesjyl]

Describe the bug
Running h5repack on a HDF5 file causes an arithmetic exception in H5S__hyper_iter_get_seq_list() during dataset copy processing. The crash occurs in the hyperslab selection iteration path while h5repack is reading dataset data through H5Dread() and do_copy_objects().

Steps to Reproduce:

PoC input:

invalid_read.zip

Command line:

./h5repack -l CONTI invalid_read out.h5

Expected behavior
h5repack should exit cleanly with an error message, rather than crashing with SIGFPE during hyperslab selection iteration.

Platform (please complete the following information)

• HDF5 version:

  • Git branch: develop

  • Commit: 8a2fb79

• OS and version:

  • Ubuntu 22.04.5 LTS

• Compiler and version:

  • clang: Ubuntu clang version 14.0.0-1ubuntu1.1

  • gcc: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

• Build system and generator:

  • CMake 4.3.2

  • Generator: Unix Makefiles, if you used the default CMake generator

• Configure options:

  • Not explicitly recorded in this run.

  • If same as the previous report:

    -DHDF5_BUILD_TOOLS=ON -DHDF5_BUILD_EXAMPLES=OFF -DHDF5_BUILD_TESTING=OFF -DHDF5_BUILD_HL_LIB=ON -DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON -DCMAKE_BUILD_TYPE=RelWithDebInfo

• MPI library and version:

  • Parallel HDF5 not enabled; no MPI library used.

Additional context
GDB output excerpt:

Program received signal SIGFPE, Arithmetic exception.

#0 0x000000000078cece in H5S__hyper_iter_get_seq_list (
iter=iter@entry=0x24dca2d0,
maxseq=maxseq@entry=1024,
maxelem=maxelem@entry=9,
nseq=nseq@entry=0x7ffc78fa9250,
nelem=nelem@entry=0x7ffc78fa9260,
off=off@entry=0x24dc4288,
len=0x24dc2228)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Shyper.c:2632
#1 0x00000000007aa82f in H5S_select_iter_get_seq_list (
iter=iter@entry=0x24dca2d0,
maxseq=maxseq@entry=1024,
maxelmts=0,
maxelmts@entry=9,
nseq=0x0,
nseq@entry=0x7ffc78fa9250,
nelmts=0x15451a0 ,
nelmts@entry=0x7ffc78fa9260,
off=off@entry=0x24dc4288,
len=0x24dc2228)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Sselect.c:1302
#2 0x000000000053093e in H5D__select_io (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dselect.c:206
#3 0x0000000000530487 in H5D__select_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dselect.c:458
#4 0x0000000000a34d4a in H5D__chunk_read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dchunk.c:3204
#5 0x0000000000523f70 in H5D__read (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5Dio.c:398
#10 H5Dread (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/src/H5D.c:1049
#11 0x0000000000435229 in do_copy_objects (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5repack/h5repack_copy.c:1053
#12 0x0000000000431bb7 in copy_objects (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5repack/h5repack_copy.c:326
#13 0x00000000004553fa in h5repack (...)
at /root/SpecDrive/benchmarks/hdf5/hdf5/tools/src/h5repack/h5repack.c:53

[gheber]

The PoC input is corrupt:

./tools/h5policy --continue-after-rejection ~/h5/invalid_read 
{
  "decision": "reject_corrupt",
  "profile": "untrusted_strict",
  "file": "/home/bob/h5/invalid_read",
  "mapping_mode": "strict",
  "phase": "0-4",
  "analysis": {
    "complete": true,
    "walk_started": true,
    "walk_completed": true,
    "stop_reason": "",
    "continue_after_rejection": true,
    "findings_truncated": false
  },
  "boundary": {
    "libhdf5": false,
    "plugins": false,
    "decompression": false,
    "external_file_opens": false,
    "repair": false,
    "writes": false,
    "application_deserialization": false
  },
  "features": {
    "external_links": 0,
    "external_storage": 0,
    "vds": 0,
    "dynamic_filters": [],
    "decode_filters": [1, 5, 6, 4],
    "unknown_messages": 1,
    "max_rank_seen": 3,
    "max_logical_dataset_bytes_seen": 33432
  },
  "metrics": {
    "metadata_bytes_seen": 66752,
    "object_count": 25,
    "attribute_count": 0,
    "object_header_chunk_count": 0,
    "chunk_index_refs": 88,
    "visited_object_headers": 25,
    "visited_continuations": 0,
    "visited_btree_refs": 28,
    "walk_operations": 8450
  },
  "findings": [
    {
      "severity": "warning",
      "code": "H5_ADVISORY_DECODE_FILTER",
      "class": "warning",
      "has_location": true,
      "offset": 49600,
      "object": "/Deflate_float_data_be",
      "message": "dataset declares the deflate/gzip filter; a consumer must decode/decompress untrusted data to read it"
    },
    {
      "severity": "warning",
      "code": "H5_ADVISORY_DECODE_FILTER",
      "class": "warning",
      "has_location": true,
      "offset": 69632,
      "object": "/Nbit_float_data_be",
      "message": "dataset declares the n-bit filter; a consumer must decode/decompress untrusted data to read it"
    },
    {
      "severity": "warning",
      "code": "H5_ADVISORY_DECODE_FILTER",
      "class": "warning",
      "has_location": true,
      "offset": 19168,
      "object": "/Scale_offset_char_data_be",
      "message": "dataset declares the scale-offset filter; a consumer must decode/decompress untrusted data to read it"
    },
    {
      "severity": "error",
      "code": "H5_POLICY_UNKNOWN_MESSAGE",
      "class": "policy",
      "has_location": true,
      "offset": 10024,
      "object": "/Scale_offset_double_data_le",
      "message": "unknown object-header message encountered",
      "evidence": {
        "field": "object_header.message_type",
        "actual": 3328,
        "expected": 24,
        "comparison": "less_than_or_equal"
      }
    },
    {
      "severity": "error",
      "code": "H5_CORRUPT_LAYOUT_RANK_MISMATCH",
      "class": "corrupt",
      "has_location": true,
      "offset": 1938,
      "object": "/Scale_offset_float_data_le",
      "message": "legacy chunked layout dimensionality does not match dataspace rank",
      "evidence": {
        "field": "layout.legacy_chunk_dimensions",
        "actual": 3,
        "expected": 4,
        "comparison": "equal"
      }
    },
    {
      "severity": "error",
      "code": "H5_CORRUPT_CHUNK_SIZE_EXCEEDS_32BIT",
      "class": "corrupt",
      "has_location": true,
      "offset": 34880,
      "object": "/Scale_offset_long_long_data_le",
      "message": "chunk byte size exceeds the legacy 32-bit chunk-size field",
      "evidence": {
        "field": "layout.chunk_size_overflow_product",
        "actual": 7545410000,
        "expected": 4294967295,
        "comparison": "less_than_or_equal"
      }
    },
    {
      "severity": "error",
      "code": "H5_CORRUPT_FILTER_NELMTS_MISMATCH",
      "class": "corrupt",
      "has_location": true,
      "offset": 34616,
      "object": "/Scale_offset_long_long_data_le",
      "message": "n-bit/scale-offset filter element count does not match the chunk element count",
      "evidence": {
        "field": "filter.decode_element_count",
        "actual": 12,
        "expected": 7545410000,
        "comparison": "equal"
      }
    },
    {
      "severity": "warning",
      "code": "H5_ADVISORY_DECODE_FILTER",
      "class": "warning",
      "has_location": true,
      "offset": 57424,
      "object": "/Szip_float_data_be",
      "message": "dataset declares the szip filter; a consumer must decode/decompress untrusted data to read it"
    }
  ]
}