---
license: mit
tags: [security, poc, hdf5]
---
# Harmless PoC: H5R__decode_obj_token token_size OOB READ

Crafted H5T_STD_REF blob with oversized `token_size` → ASan heap-buffer-overflow READ in `H5R__decode_obj_token` during `H5Dread`.

Distinct from submitted ATTR `H5R__decode_string` (51d2d9fb). Pin `abbb48b9`.

## Files
- `poc_mut_token_oob.zip` (contains `mut_token_oob_validheap.h5`, harness, ASan log)
- `mut_token_oob_validheap.h5.bytes` (same PoC, non-LFS name)
- `NOTES.md`