/* Isolated reproduction of bug #2: division by zero in H5HF__dtable_lookup (H5HFdtable.c:149) * if start_block_size == 0 (attacker-controlled, read raw from the file). */ #include int main(void) { unsigned malicious_start_block_size = 0; /* read raw from a malicious fractal-heap header */ unsigned off = 100; /* any offset within what would be the first row */ printf("H5HF__dtable_lookup: off / start_block_size = %u / %u -> ", off, malicious_start_block_size); fflush(stdout); unsigned col = off / malicious_start_block_size; /* H5HFdtable.c:149, SIGFPE on x86 for integer division by zero */ printf("%u (unreachable if division by zero traps, as it does on x86)\n", col); return 0; }