hacnho/hdf5-vlen-attr-global-heap-hang-poc

HDF5 vlen attribute/global heap hang PoC

This repository contains a minimal proof of concept for an HDF5 parser hang when reading a single-byte malformed .h5 file.

PoC URL: https://huggingface.co/hacnho/hdf5-vlen-attr-global-heap-hang-poc

Summary

The control file is a valid 12,904-byte HDF5 file with two variable-length UTF-8 root attributes and a normal scaleoffset/gzip dataset. Changing one byte at offset 0x818 from 0x1d to 0x93 keeps the file openable, but reading root attributes hangs in HDF5 global heap/vlen attribute handling.

Confirmed affected paths:

• h5py==3.16.0 linked against official HDF5 2.1.0
• official HDF5 2.1.0 h5dump -A
• stock h5py==3.16.0 wheel with bundled HDF5 2.0.0

This is not the Fletcher32 crash. The PoC has no Fletcher32 filter.

Reproduce

python3 -m venv /tmp/hdf5-vlen-attr-hang
/tmp/hdf5-vlen-attr-hang/bin/python -m pip install --upgrade pip
/tmp/hdf5-vlen-attr-hang/bin/python -m pip install -r requirements.txt
/tmp/hdf5-vlen-attr-hang/bin/python reproduce_hdf5_vlen_attr_global_heap_hang.py

Expected result:

runtime_h5py=3.16.0
runtime_hdf5=2.1.0
mutation=offset 0x818: 0x1d -> 0x93

--- control ---
returncode=0

--- malicious ---
returncode=timeout_after_8s
stdout:
h5py=3.16.0 hdf5=2.1.0
opened

The malicious file opens successfully and hangs when root variable-length attributes are read.

Files

• reproduce_hdf5_vlen_attr_global_heap_hang.py - deterministic one-byte builder and reproducer.
• control_scaleoffset_int.h5 - valid HDF5 control file.
• hdf5_vlen_attr_global_heap_single_byte_hang.h5 - same-size file with one byte changed.
• reproduce-output-hdf5-2.1.0.txt - captured reproduction against HDF5 2.1.0.
• scaleoffset-attr-hang-hdf5-2.1.0-gdb-bt.txt - native stack snapshot.
• h5dump-2.1.0-control.txt and h5dump-2.1.0-poc.txt - HDF5 tool evidence.
• environment.txt - tested package and runtime versions.
• duplicate-check.md - local/public duplicate review.
• report.md - full report draft.
• SHA256SUMS.txt - artifact hashes.

Notes

No code execution is claimed. The demonstrated impact is process-level denial of service via unbounded CPU/hang in HDF5 global heap/vlen attribute parsing.