HDF5 Heap-Based Buffer Overflow Vulnerability in H5O__fsinfo_encode Function

A heap-based buffer overflow vulnerability has been identified in HDF5 version 1.14.6. This issue arises in the H5O__fsinfo_encode function within the file /src/H5Ofsinfo.c. The vulnerability can be exploited locally, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by compiling HDF5 with AddressSanitizer enabled, using Clang as the compiler. After building the library, the H5 extended fuzzer, also available on GitHub, can be used to trigger the vulnerability by sending specially crafted input that exploits the buffer overflow in the H5O__fsinfo_encode function.