Repository navigation
Conversation
tbeu
requested review from
fortnern,
glennsong09,
hyoklee,
jhendersonHDF,
lrknox,
mattjala and
vchoi-hdfgroup
as code owners
October 20, 2026 18:31
github-actions
Bot
removed request for
fortnern,
glennsong09,
hyoklee,
mattjala and
vchoi-hdfgroup
October 20, 2026 18:58
Contributor
Review ChecklistThis PR touches the following areas. Each needs a sign-off
|
H5D__chunk_set_info_real() divided by the chunk dimension before validating that it was non-zero, and the existing check was only reached when the maximum dimension was not H5S_UNLIMITED. A corrupt file encoding a zero-sized chunk dimension therefore crashed the library with an integer division by zero (FPE) while the dataset was being opened. One-dimensional datasets were reachable because H5D__chunk_init() validates the chunk dimensions only for datasets with more than one dimension. Validate the chunk dimension before the divisions, covering both the limited and unlimited cases. Such a dataset is now rejected with a normal error. Reported by OSS-Fuzz via matio.
tbeu
force-pushed
the
fix-zero-chunk-dim-fpe
branch
from
October 20, 2026 21:13
46acf16 to
8dbf869
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
H5D__chunk_set_info_real()computed the number of chunks in each dimension by dividing by the chunk dimension before validating that the dimension was non-zero. The existing validation was additionally only reached in theelsebranch, i.e. when the maximum dimension was notH5S_UNLIMITED. A corrupt file that encoded a zero-sized chunk dimension therefore triggered an integer division by zero (a floating point exception) while the dataset was being opened.One-dimensional datasets were reachable because
H5D__chunk_init()validates the chunk dimensions only inside itsif (dset->shared->ndims > 1)block, so a 1-D chunked dataset with a zero chunk dimension reachedH5D__chunk_set_info()->H5D__chunk_set_info_real()unguarded. This matches the crash stack reported below (H5D__chunk_init->H5D__chunk_set_info->H5D__chunk_set_info_real).Solution
The chunk dimension is now validated before the divisions, covering every dimension and both the limited and unlimited cases. Such a dataset is rejected with a normal HDF5 error instead of crashing.
Reproducer
Opening dataset
i16fromclusterfuzz-testcase-minimized-matio_hyperslab_fuzzer-4546410763321344(found via matio) crashes withSTATUS_INTEGER_DIVIDE_BY_ZERO(0xC0000094) on Windows and an ASanFPEon Linux. After the fix,H5Dopenreturns an error and the library no longer crashes.Links
dim == 0guard for this routine but placed it after the division and only in thendims > 1path.