fix(format): dataspaces and contiguous storage as libhdf5 reads them
- A simple dataspace of rank 0 holds one element in libhdf5 (the product
of no dimensions; h5py reads it as shape ()). num_elements() said 0, so
cve-2020-18494's /dset1 failed with DataSizeMismatch { expected: 0 }.
- A contiguous dataset whose storage is larger than its elements reads:
libhdf5 reads the elements from the start of the storage and ignores the
rest (H5D__contig_check checks only that they fit in the file). We
required the sizes to be equal, so the scalar /Dset1 of cve-2024-32623
and cve-2025-2309 (240 bytes of storage for one int) failed. Storage too
small for the elements is still an error. data_read::contiguous_read_len
is the rule, used by every contiguous read path.
- Dataspace::parse refuses what H5O__sdspace_decode refuses: more than 32
dimensions, a rank on a scalar or null dataspace, a dimension larger
than its maximum (new FormatError::InvalidDataspace).
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
This commit is contained in:
@@ -390,13 +390,7 @@ impl<'f> MmapDataset<'f> {
|
||||
match &dl {
|
||||
DataLayout::Contiguous { address, size } => {
|
||||
let addr = address.ok_or(Error::Format(FormatError::NoDataAllocated))?;
|
||||
let sz = *size as usize;
|
||||
if sz != expected {
|
||||
return Err(Error::Format(FormatError::DataSizeMismatch {
|
||||
expected,
|
||||
actual: sz,
|
||||
}));
|
||||
}
|
||||
let sz = clawhdf5_format::data_read::contiguous_read_len(*size, expected)?;
|
||||
let data = self.file.hdf5_bytes();
|
||||
let a = addr as usize;
|
||||
if a + sz > data.len() {
|
||||
|
||||
Reference in New Issue
Block a user