osobhandClaude Opus 5.5 a5ca970015 fix: refuse numeric types with unusually many unused bits in v1 headers ...

libhdf5 1.14.4+ treats an integer, float or bit field wider than a byte
whose precision and offset leave more than half its bits unused as
corruption when the type sits in a header without a checksum (version 1),
unless the file is opened with H5Pset_relax_file_integrity_checks
(H5T_is_numeric_with_unusual_unused_bits). clawhdf5 read such types,
e.g. a 3-bit integer in 4 bytes (cve-2024-29162) or a 32-bit float in
65525 bytes (cve-2024-32614, tmisc38a.h5).

New Datatype::check_unused_bits (recursive) and Datatype::parse_in_header,
which applies it for version-1 headers. Dataset datatypes (facade File,
LazyFile, MmapFile; clawhdf5-io VOL, MPI VOL, async reader; the
conformance probe) and compact attributes in version-1 headers use it.

Conformance (cached corpus, tank): 570 ok, unchanged; cve-2024-29162,
cve-2024-32614 and tmisc38a.h5 now refuse the object h5py refuses, and
tmisc38b.h5 / unknown-1.h5 now fail with libhdf5's reason.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-09-26 00:12:04 -05:00

..

clawhdf5

fix: refuse numeric types with unusually many unused bits in v1 headers

2026-09-26 00:12:04 -05:00

clawhdf5-accel

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00

clawhdf5-agent

fix(agent): fail to open a store whose /meta has an unreadable attribute

2026-09-25 22:43:53 -05:00

clawhdf5-android

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00

clawhdf5-ann

fix(format): apply the base address of files with a user block

2026-09-25 22:07:50 -05:00

clawhdf5-bench

feat(agent): Ed25519-signed checkpoints

2026-09-25 10:13:34 -05:00

clawhdf5-cli

feat(agent): Ed25519-signed checkpoints

2026-09-25 10:13:34 -05:00

clawhdf5-derive

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00

clawhdf5-filters

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00

clawhdf5-format

fix: refuse numeric types with unusually many unused bits in v1 headers

2026-09-26 00:12:04 -05:00

clawhdf5-gpu

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00

clawhdf5-io

fix: refuse numeric types with unusually many unused bits in v1 headers

2026-09-26 00:12:04 -05:00

clawhdf5-migrate

docs: withdraw the ZeroClaw integration claims

2026-09-25 11:08:41 -05:00

clawhdf5-napi

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00

clawhdf5-netcdf4

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00

clawhdf5-py

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00

libaec-sys

build: declare Rust 1.92 as the MSRV and check it in CI

2026-09-23 11:05:26 -05:00