netcdf-dimarray-intoverflow-poc

PoC .nc for an integer overflow → out-of-bounds read in libnetcdf's classic header parser, hit just by opening the file with netCDF4.Dataset().

the classic NetCDF header stores the dimension-array count as a 64-bit int that flows straight into calloc(1, nelems * sizeof(NC_dim*)) in libsrc/v1hpg.c:544 with no overflow/bounds check. pick nelems=0x8000000000000002 → the *8 wraps to 0x10 (16-byte buffer) but nelems stays huge, so the loop reads exactly 2 dims and nc_open returns "success" with a poisoned handle. later NC_var_shape's dimid >= dims->nelems bound is defeated by the huge count → OOB read of dims->value[...] → wild deref → SIGSEGV at open. same pattern in v1h_get_NC_vararray. main added a SIZE_MAX/sizeof guard; 4.9.3 has none.

files

evil_dim.nc / poc.nc — the crafted classic/CDF-5 headers that trigger the overflow.
gen_poc.py — generates them.
harness.c — minimal C harness for the ASAN trace against a from-source libnetcdf build.

repro

pip install netCDF4        # bundles libnetcdf 4.9.3 / libhdf5 1.14.6
python -c "import netCDF4; netCDF4.Dataset('evil_dim.nc')"   # deterministic SIGSEGV at open

OOB read → crash / DoS on open of an untrusted data file. not shown: memory leak or code-exec — the wild pointer is consumed internally.