hacnho/hdf5-gzip-dataset-memory-bomb-poc

HDF5 gzip dataset memory-bomb PoC

This repository hosts a benign security research PoC for an HDF5 parser / loader denial of service.

Files

• hdf5-gzip-zeros-1200m.h5

Reproduction

python3 - <<'PY'
import h5py
with h5py.File("hdf5-gzip-zeros-1200m.h5", "r") as f:
    arr = f["x"][()]
    print(arr.shape)
PY

Observed on the research machine:

• on-disk file size is about 1.4 KB
• logical dataset expands to about 1.2 GB
• under a 1,000 MB memory cap the read fails with _ArrayMemoryError

Safety note

This artifact is a non-executable malformed model-file PoC for parser-stress testing only.