| # netcdf-dimarray-intoverflow-poc | |
| PoC `.nc` for an integer overflow → out-of-bounds read in libnetcdf's classic header parser, hit just by opening the file with `netCDF4.Dataset()`. | |
| the classic NetCDF header stores the dimension-array count as a 64-bit int that flows straight into `calloc(1, nelems * sizeof(NC_dim*))` in `libsrc/v1hpg.c:544` with no overflow/bounds check. pick `nelems=0x8000000000000002` → the `*8` wraps to `0x10` (16-byte buffer) but `nelems` stays huge, so the loop reads exactly 2 dims and `nc_open` returns "success" with a poisoned handle. later `NC_var_shape`'s `dimid >= dims->nelems` bound is defeated by the huge count → OOB read of `dims->value[...]` → wild deref → SIGSEGV at open. same pattern in `v1h_get_NC_vararray`. `main` added a `SIZE_MAX/sizeof` guard; 4.9.3 has none. | |
| ## files | |
| - `evil_dim.nc` / `poc.nc` — the crafted classic/CDF-5 headers that trigger the overflow. | |
| - `gen_poc.py` — generates them. | |
| - `harness.c` — minimal C harness for the ASAN trace against a from-source libnetcdf build. | |
| ## repro | |
| pip install netCDF4 # bundles libnetcdf 4.9.3 / libhdf5 1.14.6 | |
| python -c "import netCDF4; netCDF4.Dataset('evil_dim.nc')" # deterministic SIGSEGV at open | |
| OOB read → crash / DoS on open of an untrusted data file. not shown: memory leak or code-exec — the wild pointer is consumed internally. | |