infinite loop closing library

[gabe-sherman]

I am an undergraduate student exploring automatic fuzzing harness generation for open source api's. When running the below code with the linked file, the following error is printed.:

HDF5: infinite loop closing library L,T_top,P,P,Z,FD,VL,VL,PL,E,SL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL Aborted

I don't have extensive knowledge of this library so I'm not able to determine whether this message is from user error or if this is an actual issue. Any help is appreciated!

The program this is occurring in is below:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include "hdf5.h"

int main(int argc, char *argv[])
{
   char* fuzzData = argv[1];

   hid_t H5Fopenval = H5Fopen(fuzzData, H5F_ACC_RDWR, H5P_DEFAULT);
   if(H5Fopenval != H5I_INVALID_HID){
      H5Fclose(H5Fopenval);
      exit(0);
   }
   hid_t H5Gcreate2val = H5Gcreate2(H5Fopenval, "str", H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT);
   H5Gclose(H5Gcreate2val);
   H5Fclose(H5Fopenval);
   exit(0);
}

Test Environment

Ubuntu 22.04, 64bit

How to trigger

Run the compiled program and pass poc-filename as argument

POC File

https://github.com/FuturesLab/POC/blob/main/hdf5/id%3A000001%2Csig%3A06%2Csrc%3A000003%2Ctime%3A1883%2Cexecs%3A799%2Cop%3Ahavoc%2Crep%3A6

[derobins]

Which version of the library is this?

[gabe-sherman]

This is the commit: https://github.com/HDFGroup/hdf5/commit/e4fb67c84aa4a4983e2cee4994235600d813a9ee

[vchoi-hdfgroup]

I couldn't reproduce the problem as described in the issue--with the current develop branch and with the commit listed above). I also run valgrind with the test program and there is no memory leak.

[gabe-sherman]

Here's the valgrind summary using the h5dump utility with the POC file above renamed to poc:

$ valgrind ./hdf5_new/build/bin/h5dump poc

==2284717== Memcheck, a memory error detector
==2284717== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==2284717== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
==2284717== Command: ./hdf5_new/build/bin/h5dump poc
==2284717==
h5dump error: unable to open file "poc"
HDF5: infinite loop closing library
      L,T_top,P,P,Z,FD,VL,VL,PL,E,SL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL,FL
==2284717==
==2284717== Process terminating with default action of signal 6 (SIGABRT)
==2284717==    at 0x4A0D9FC: __pthread_kill_implementation (pthread_kill.c:44)
==2284717==    by 0x4A0D9FC: __pthread_kill_internal (pthread_kill.c:78)
==2284717==    by 0x4A0D9FC: pthread_kill@@GLIBC_2.34 (pthread_kill.c:89)
==2284717==    by 0x49B9475: raise (raise.c:26)
==2284717==    by 0x499F7F2: abort (abort.c:79)
==2284717==    by 0x158FFB: H5_term_library (in /hdf5/hdf5_new/build/bin/h5dump)
==2284717==    by 0x15AAD6: H5close (in /hdf5/hdf5_new/build/bin/h5dump)
==2284717==    by 0x131F94: h5tools_close (in /hdf5/hdf5_new/build/bin/h5dump)
==2284717==    by 0x1190EC: leave (in /hdf5/hdf5_new/build/bin/h5dump)
==2284717==    by 0x11D7A8: main (in /hdf5/hdf5_new/build/bin/h5dump)
==2284717==
==2284717== HEAP SUMMARY:
==2284717==     in use at exit: 2,256 bytes in 6 blocks
==2284717==   total heap usage: 3,359 allocs, 3,353 frees, 2,463,341 bytes allocated
==2284717==
==2284717== LEAK SUMMARY:
==2284717==    definitely lost: 1,760 bytes in 4 blocks
==2284717==    indirectly lost: 0 bytes in 0 blocks
==2284717==      possibly lost: 0 bytes in 0 blocks
==2284717==    still reachable: 496 bytes in 2 blocks
==2284717==         suppressed: 0 bytes in 0 blocks
==2284717== Rerun with --leak-check=full to see details of leaked memory
==2284717==
==2284717== For lists of detected and suppressed errors, rerun with: -s
==2284717== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Aborted