You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

netcdf-dimarray-intoverflow-poc

PoC .nc for an integer overflow → out-of-bounds read in libnetcdf's classic header parser, hit just by opening the file with netCDF4.Dataset().

the classic NetCDF header stores the dimension-array count as a 64-bit int that flows straight into calloc(1, nelems * sizeof(NC_dim*)) in libsrc/v1hpg.c:544 with no overflow/bounds check. pick nelems=0x8000000000000002 → the *8 wraps to 0x10 (16-byte buffer) but nelems stays huge, so the loop reads exactly 2 dims and nc_open returns "success" with a poisoned handle. later NC_var_shape's dimid >= dims->nelems bound is defeated by the huge count → OOB read of dims->value[...] → wild deref → SIGSEGV at open. same pattern in v1h_get_NC_vararray. main added a SIZE_MAX/sizeof guard; 4.9.3 has none.

files

evil_dim.nc / poc.nc — the crafted classic/CDF-5 headers that trigger the overflow.
gen_poc.py — generates them.
harness.c — minimal C harness for the ASAN trace against a from-source libnetcdf build.

repro

pip install netCDF4        # bundles libnetcdf 4.9.3 / libhdf5 1.14.6
python -c "import netCDF4; netCDF4.Dataset('evil_dim.nc')"   # deterministic SIGSEGV at open

OOB read → crash / DoS on open of an untrusted data file. not shown: memory leak or code-exec — the wild pointer is consumed internally.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support