From e7846f158742a9ee0f526dde74bf34b3dba4975e Mon Sep 17 00:00:00 2001 From: naruto-lgtm Date: Sat, 20 Jun 2026 13:07:06 +0530 Subject: [PATCH] validate free space section type during sinfo decode --- release_docs/CHANGELOG.md | 4 ++++ src/H5FScache.c | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/release_docs/CHANGELOG.md b/release_docs/CHANGELOG.md index c9d5ac47ad65..4b8b3543ea23 100644 --- a/release_docs/CHANGELOG.md +++ b/release_docs/CHANGELOG.md @@ -144,6 +144,10 @@ The `h5repack` tool now obtains its default low and high library version bounds ## Library +### Validate free space section type during decode + + When loading a free space section info block, the per-section type byte read from the file was used directly to index the free space manager's section class array and to call the class `deserialize` callback, guarded only by an assertion that is removed in release builds. A corrupted or fuzzed file could supply a type beyond the number of registered classes, causing an out-of-bounds read of the class array and an indirect call through a bogus function pointer. `H5FS__cache_sinfo_deserialize()` now rejects a section type that is not less than the number of section classes. + ### HTTP 403 errors in the ROS3 VFD for object keys with special characters The ROS3 VFD did not URI-encode the S3 object key when building the HTTP request path, so keys containing characters that AWS Signature Version 4 requires to be percent-encoded — such as the '=' in Hive-style `key=value` partition prefixes, '+', or spaces — produced a signed request whose signature did not match S3's server-side recomputation. S3 rejects such requests with `SignatureDoesNotMatch`, which surfaces as an HTTP 403 error (indistinguishable from a permissions error on a HEAD request), even though tools like the AWS CLI could access the same object. The object key is now percent-encoded exactly once when the request path is built, matching the behavior of other S3 clients. Note that URLs must now be passed to the ROS3 VFD with their object keys unencoded; a key that was pre-encoded as a workaround for this issue will now be double-encoded and fail to resolve. diff --git a/src/H5FScache.c b/src/H5FScache.c index 7d19f59976ab..844685105b75 100644 --- a/src/H5FScache.c +++ b/src/H5FScache.c @@ -1012,6 +1012,13 @@ H5FS__cache_sinfo_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED l /* The type of this section */ sect_type = *image++; + /* Validate the section type before using it to index the class + * array, otherwise a corrupted file can drive an out-of-bounds + * read and an indirect call through a bogus function pointer. + */ + if (sect_type >= fspace->nclasses) + HGOTO_ERROR(H5E_FSPACE, H5E_CANTLOAD, NULL, "invalid free space section type"); + /* Call 'deserialize' callback for this section */ des_flags = 0; assert(fspace->sect_cls[sect_type].deserialize);