You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Harmless PoC: HDF5 `H5R__decode_string` ATTR-ref strlen OOB read

After H5T__ref_disk_read / blob_get size checks pass, H5R__decode_string trusts a blob uint16 name length with no remaining-buffer check → ASan heap-buffer-overflow READ on H5Dread of crafted H5T_STD_REF ATTR refs.

Distinct from CVE-2026-29043 (H5T__ref_mem_setnull).

Files

mismatch_attr_strlen.h5, poc_read_ref.c, asan.log, NOTES.md

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

You need to agree to share your contact information to access this model

Harmless PoC: HDF5 H5R__decode_string ATTR-ref strlen OOB read

Files

Harmless PoC: HDF5 `H5R__decode_string` ATTR-ref strlen OOB read