poc_fractalheap_divzero.c

/* Isolated reproduction of bug #2: division by zero in H5HF__dtable_lookup (H5HFdtable.c:149)
 * if start_block_size == 0 (attacker-controlled, read raw from the file). */
#include <stdio.h>

int main(void) {
    unsigned malicious_start_block_size = 0; /* read raw from a malicious fractal-heap header */
    unsigned off = 100;                       /* any offset within what would be the first row */
    printf("H5HF__dtable_lookup: off / start_block_size = %u / %u -> ", off, malicious_start_block_size);
    fflush(stdout);
    unsigned col = off / malicious_start_block_size; /* H5HFdtable.c:149, SIGFPE on x86 for integer division by zero */
    printf("%u (unreachable if division by zero traps, as it does on x86)\n", col);
    return 0;
}