hacnho/netcdf-attrlen-slow-poc

NetCDF title-attribute-length slow-parse PoC

This repository contains a benign security research proof of concept for tiny valid NetCDF3 files whose global title attribute length metadata is mutated to force multi-second parsing in netCDF4.Dataset.

Files

• seed-netcdf3_classic.nc - clean NETCDF3_CLASSIC control file
• malicious-title-len-classic.nc - 1-byte mutated NETCDF3_CLASSIC file
• seed-netcdf3_64bit_offset.nc - clean NETCDF3_64BIT_OFFSET control file
• malicious-title-len-64bit.nc - 1-byte mutated NETCDF3_64BIT_OFFSET file
• build-meta-attrlen.json - measurement summary
• reproduce_netcdf_attrlen_slow.py - replay helper

What it demonstrates

The mutated files are only 412 and 424 bytes, but netCDF4.Dataset spends about 8.6 s parsing them, while the clean controls load in about 0.10 s.

Quick repro

Install:

• netCDF4==1.7.2

Then run:

python reproduce_netcdf_attrlen_slow.py

Expected output shape:

[
  {"path":"...seed-netcdf3_classic.nc","returncode":0,"elapsed_ms":105.935},
  {"path":"...malicious-title-len-classic.nc","returncode":0,"elapsed_ms":8580.469},
  {"path":"...seed-netcdf3_64bit_offset.nc","returncode":0,"elapsed_ms":104.607},
  {"path":"...malicious-title-len-64bit.nc","returncode":0,"elapsed_ms":8602.442}
]

This PoC is intended for defensive validation and bug bounty triage only.