validate free space section type during sinfo decode

release_docs/CHANGELOG.md

@@ -144,6 +144,10 @@ The `h5repack` tool now obtains its default low and high library version bounds
 
 ## Library
 
+### Validate free space section type during decode
+
+   When loading a free space section info block, the per-section type byte read from the file was used directly to index the free space manager's section class array and to call the class `deserialize` callback, guarded only by an assertion that is removed in release builds. A corrupted or fuzzed file could supply a type beyond the number of registered classes, causing an out-of-bounds read of the class array and an indirect call through a bogus function pointer. `H5FS__cache_sinfo_deserialize()` now rejects a section type that is not less than the number of section classes.
+
 ### HTTP 403 errors in the ROS3 VFD for object keys with special characters
 
    The ROS3 VFD did not URI-encode the S3 object key when building the HTTP request path, so keys containing characters that AWS Signature Version 4 requires to be percent-encoded — such as the '=' in Hive-style `key=value` partition prefixes, '+', or spaces — produced a signed request whose signature did not match S3's server-side recomputation. S3 rejects such requests with `SignatureDoesNotMatch`, which surfaces as an HTTP 403 error (indistinguishable from a permissions error on a HEAD request), even though tools like the AWS CLI could access the same object. The object key is now percent-encoded exactly once when the request path is built, matching the behavior of other S3 clients. Note that URLs must now be passed to the ROS3 VFD with their object keys unencoded; a key that was pre-encoded as a workaround for this issue will now be double-encoded and fail to resolve.

src/H5FScache.c

@@ -1012,6 +1012,13 @@ H5FS__cache_sinfo_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED l
                 /* The type of this section */
                 sect_type = *image++;
 
+                /* Validate the section type before using it to index the class
+                 * array, otherwise a corrupted file can drive an out-of-bounds
+                 * read and an indirect call through a bogus function pointer.
+                 */
+                if (sect_type >= fspace->nclasses)
+                    HGOTO_ERROR(H5E_FSPACE, H5E_CANTLOAD, NULL, "invalid free space section type");
+
                 /* Call 'deserialize' callback for this section */
                 des_flags = 0;
                 assert(fspace->sect_cls[sect_type].deserialize);