heap-buffer-overflow in H5Fio.c

[gabe-sherman]

A heap-buffer-overflow occurs in the h5dump program when provided with a malformed input. This behavior occurs at line 515 in H5Fio.c

How to trigger

LD_PRELOAD=path-to/libhdf5.so h5dump poc

POC File

https://github.com/FuturesLab/POC/blob/main/hdf5/poc-09

Test Environment

Ubuntu 22.04, 64bit

Version

Latest: 0394b03f66dc45fe96e2c772b7bce293e4316ad2

Address Sanitizer Output

=================================================================
==1414505==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000486f at pc 0x555556b4c45f bp 0x7fffffffca90 sp 0x7fffffffca88
READ of size 1 at 0x60200000486f thread T0
    #0 0x555556b4c45e in H5F_get_checksums /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Fio.c:515:9
    #1 0x555556f82f04 in H5O__cache_verify_chksum /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Ocache.c:226:9
    #2 0x5555567c0393 in H5C__load_entry /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Centry.c:1167:28
    #3 0x5555567c0393 in H5C_protect /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Centry.c:3101:30
    #4 0x5555566414c2 in H5AC_protect /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5AC.c:1276:26
    #5 0x55555704e944 in H5O_protect /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Oint.c:988:32
    #6 0x5555570a9457 in H5O_msg_exists /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Omessage.c:787:23
    #7 0x555556cf010d in H5G_mkroot /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Groot.c:217:32
    #8 0x555556b1d0d6 in H5F_open /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Fint.c:2096:13
    #9 0x555557a1915e in H5VL__native_file_open /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5VLnative_file.c:127:29
    #10 0x555557992223 in H5VL__file_open /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5VLcallback.c:3629:30
    #11 0x55555799158b in H5VL_file_open /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5VLcallback.c:3778:30
    #12 0x555556ae7a06 in H5F__open_api_common /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5F.c:786:29
    #13 0x555556ae6e05 in H5Fopen /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5F.c:826:22
    #14 0x5555566003d6 in main /home/gabesherman/harness_test/AutoHarn-Results/hdf5/autoharn-09/harness.c:17:24
    #15 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #16 0x7ffff7c29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #17 0x555556542624 in _start (/home/gabesherman/harness_test/AutoHarn-Results/hdf5/autoharn-09/harness+0xfee624) (BuildId: 67f4887fb70b6fd34e79663298e99802e72ccb93)

0x60200000486f is located 1 bytes to the left of 3-byte region [0x602000004870,0x602000004873)
allocated by thread T0 here:
    #0 0x5555565c5896 in __interceptor_realloc (/home/gabesherman/harness_test/AutoHarn-Results/hdf5/autoharn-09/harness+0x1071896) (BuildId: 67f4887fb70b6fd34e79663298e99802e72ccb93)
    #1 0x555556f4fdea in H5MM_realloc /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5MM.c:87:21
    #2 0x5555566414c2 in H5AC_protect /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5AC.c:1276:26

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/gabesherman/harness_test/AutoHarn-Evaluation/hdf5/lib_asan/src/H5Fio.c:515:9 in H5F_get_checksums
Shadow bytes around the buggy address:
  0x0c047fff88b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff88c0: fa fa 04 fa fa fa fd fd fa fa 00 00 fa fa 00 00
  0x0c047fff88d0: fa fa 04 fa fa fa 01 fa fa fa 01 fa fa fa 04 fa
  0x0c047fff88e0: fa fa 00 fa fa fa 00 fa fa fa 00 00 fa fa 00 00
  0x0c047fff88f0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff8900: fa fa 00 00 fa fa 00 fa fa fa 00 00 fa[fa]03 fa
  0x0c047fff8910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1414505==ABORTING