fix(tools,wasm): resolve VL data through the library's VlResolver

h5rs (dump, ls, diff, check --data) kept its own lenient VL decoder:
a heap object longer than its element was cut to the element's length
(libhdf5 and h5py refuse it), a null string printed "" where h5dump
prints NULL, the stored element size was trusted, and every heap
collection was kept as an owned copy for the whole run. It now resolves
each element with VlResolver::element / string_element (new: one element
in place, borrowing from the file), and refuses a VL type whose stored
element size is not 4 + offset size + 4, as File does. H5::heap_object
and its cache are gone. h5diff compares a null VL string equal to an
empty one; so does h5rs diff.

clawhdf5-wasm already resolved VL strings with read_vl_strings; it now
uses VlResolver and checks the stored element size before reading, as
File::read_string does.

Tests (h5py writes the files, patched for "a\0b", a null element and
mis-sized heap objects, with 8- and 4-byte offsets):
- h5rs_interop dump_prints_vl_data_like_h5dump: byte-identical to h5dump;
- dump_json_vl_values_match_h5py: h5py's values, errors where h5py fails;
- check_data_flags_mis_sized_vl_heap_objects;
- clawhdf5-wasm tests/vl_strings.rs: wasm, File and h5py agree.
All four fail before. check --data over the 150 cve_hdf5 CVE and fuzzer
files now passes 15 (h5dump rejects 8 of them), was 16 and 9: the
stored-size check flags cve-2024-32608. h5rs-check-ok-files.sh --data:
0 of 422 flagged; h5rs-fuzz.sh: clean on 180 files.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/clawhdf5-tools/src/h5.rs

@@ -8,7 +8,6 @@
 use std::cell::RefCell;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
-use std::rc::Rc;
 
 use clawhdf5::File;
 use clawhdf5_format::attribute::{AttributeMessage, extract_attributes_tolerant};
@@ -20,7 +19,6 @@ use clawhdf5_format::datatype::Datatype;
 use clawhdf5_format::error::FormatError;
 use clawhdf5_format::filter_pipeline::FilterPipeline;
 use clawhdf5_format::fractal_heap::FractalHeapHeader;
-use clawhdf5_format::global_heap::GlobalHeapCollection;
 use clawhdf5_format::group_v1;
 use clawhdf5_format::link_info::LinkInfoMessage;
 use clawhdf5_format::link_message::{LinkMessage, LinkTarget};
@@ -191,7 +189,6 @@ pub struct H5 {
     pub path: PathBuf,
     pub file: File,
     pub max_bytes: u64,
-    heaps: RefCell<HashMap<u64, std::result::Result<Rc<GlobalHeapCollection>, String>>>,
     /// Fractal heaps whose blocks were verified: `None` = sound.
     verified_heaps: RefCell<HashMap<u64, Option<Error>>>,
 }
@@ -211,7 +208,6 @@ impl H5 {
             path: path.to_path_buf(),
             file,
             max_bytes: DEFAULT_MAX_BYTES,
-            heaps: RefCell::new(HashMap::new()),
             verified_heaps: RefCell::new(HashMap::new()),
         })
     }
@@ -433,29 +429,6 @@ impl H5 {
         r.map_or(Ok(()), Err)
     }
 
-    /// The global heap object `idx` of the collection at `addr` (cached per
-    /// collection).
-    pub fn heap_object(&self, addr: u64, idx: u32) -> Result<Vec<u8>> {
-        let coll = {
-            let mut cache = self.heaps.borrow_mut();
-            cache
-                .entry(addr)
-                .or_insert_with(|| match usize::try_from(addr) {
-                    Ok(a) => GlobalHeapCollection::parse(self.data(), a, self.ls())
-                        .map(Rc::new)
-                        .map_err(|e| e.to_string()),
-                    Err(_) => Err("address out of range".into()),
-                })
-                .clone()
-                .map_err(|e| Error::at(addr, format!("global heap: {e}")))?
-        };
-        let idx16 = u16::try_from(idx)
-            .map_err(|_| Error::at(addr, format!("global heap object index {idx} out of range")))?;
-        coll.get_object(idx16)
-            .map(|o| o.data.clone())
-            .ok_or_else(|| Error::at(addr, format!("global heap has no object {idx}")))
-    }
-
     /// The dataspace of the dataset at `path` with a virtual dataset's
     /// extent resolved from its sources (as libhdf5 reports it) instead of
     /// the stored one.