CVE-2016-4332

In HDF5 version 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in the libhdf5.a library. For example, using h5dump may crash or have unspecified other impacts when opening a crafted hdf5 file.

The HDF5 1.8.16 library has a vulnerability that allows modification of the loop's index when initializing an array, potentially leading to out-of-bounds access. The value used for space allocation comes from the file, creating a risk of manipulation by an attacker.

When decoding data out of a dataset encoded with the H5Z_NBIT decoding, the HDF5 1.8.16 library fails to ensure that the precision is within the bounds of the size, leading to arbitrary code execution.

The HDF5 library version 1.8.16 has a flaw in failing to check if the number of dimensions for an array read from the file is within the bounds of the allocated space. This can lead to a heap-based buffer overflow, potentially allowing arbitrary code execution.

A vulnerability in HDF5 through 2.3.0 in the H5Z__filter_fletcher32 function in H5Zfletcher32.c. The function computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g., by the h5ls or h5dump tools.

A vulnerability in HDF5 through 2.3.0 in the H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c. These functions advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g., by the h5ls or h5repack tools.

H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.

H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.

NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0. Attackers can cause denial of service via a dataset with 'defined' flag and negative size field.

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.