fix(format): dataspaces and contiguous storage as libhdf5 reads them

- A simple dataspace of rank 0 holds one element in libhdf5 (the product
  of no dimensions; h5py reads it as shape ()). num_elements() said 0, so
  cve-2020-18494's /dset1 failed with DataSizeMismatch { expected: 0 }.
- A contiguous dataset whose storage is larger than its elements reads:
  libhdf5 reads the elements from the start of the storage and ignores the
  rest (H5D__contig_check checks only that they fit in the file). We
  required the sizes to be equal, so the scalar /Dset1 of cve-2024-32623
  and cve-2025-2309 (240 bytes of storage for one int) failed. Storage too
  small for the elements is still an error. data_read::contiguous_read_len
  is the rule, used by every contiguous read path.
- Dataspace::parse refuses what H5O__sdspace_decode refuses: more than 32
  dimensions, a rank on a scalar or null dataspace, a dimension larger
  than its maximum (new FormatError::InvalidDataspace).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
This commit is contained in:
osobh
2026-09-26 10:17:15 -05:00
co-authored by Claude Opus 5.5
parent 16b7359485
commit 3aab433edb
4 changed files with 124 additions and 35 deletions
+1 -7
View File
@@ -390,13 +390,7 @@ impl<'f> MmapDataset<'f> {
match &dl {
DataLayout::Contiguous { address, size } => {
let addr = address.ok_or(Error::Format(FormatError::NoDataAllocated))?;
let sz = *size as usize;
if sz != expected {
return Err(Error::Format(FormatError::DataSizeMismatch {
expected,
actual: sz,
}));
}
let sz = clawhdf5_format::data_read::contiguous_read_len(*size, expected)?;
let data = self.file.hdf5_bytes();
let a = addr as usize;
if a + sz > data.len() {