From 8295d016141ea491bfe892b1f7462cab8f0fb4db Mon Sep 17 00:00:00 2001 From: osobh Date: Sat, 26 Sep 2026 10:37:40 -0500 Subject: [PATCH] format: a chunk offset past usize writes nothing Placing a chunk cast its u64 offsets to usize; on a 32-bit target an offset past the address space wrapped into the output (and could then overlap another chunk's region when chunks are placed concurrently). Such an offset is past the dataset, so it now saturates and the chunk writes nothing, as the concurrent-placement check already assumed. No change on 64-bit targets, where the cast cannot wrap (so no test here). Co-Authored-By: Claude Opus 5.5 (1M context) --- crates/clawhdf5-format/src/chunked_read.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/crates/clawhdf5-format/src/chunked_read.rs b/crates/clawhdf5-format/src/chunked_read.rs index 712aab8..ddadda7 100644 --- a/crates/clawhdf5-format/src/chunked_read.rs +++ b/crates/clawhdf5-format/src/chunked_read.rs @@ -155,7 +155,9 @@ impl ChunkPlacer { &mut long }; for (o, &off) in chunk_offsets.iter_mut().zip(offsets) { - *o = off as usize; + // An offset past `usize` is past the dataset: the chunk writes + // nothing (a plain cast would wrap it into the output). + *o = usize::try_from(off).unwrap_or(usize::MAX); } // SAFETY: the caller's contract. unsafe {