Fixed-length strings read past the end of their field

Abierto
  • ¿Algo no está bien?
#504 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@mattjala ya está trabajando en esto.

Desde el 13/10/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Component - Object Library

A fixed-length string only carries a terminator when its field is longer than the text it
holds. The HDF5 JNI reads these strings by handing the raw element address to
NewStringUTF, which reads until it finds a terminator, so a string that fills its field
runs on into whatever follows it. HDFView displays those neighbouring bytes as part of the
value wherever it reads the string through H5DreadVL.

The data is already wrong when it crosses the JNI boundary, so HDFView cannot fix the
values. It can detect the condition, which is covered at the end.

Root cause

java/src-jni/jni/h5util.c in the HDF5 source, the H5T_STRING case of
translate_atomic_rbuf:

else {
    if (NULL == (jobj = ENVPTR->NewStringUTF(ENVONLY, char_buf))) {

char_buf points at the element. Nothing bounds the read to the element's size. The
variable-length branch just above it is fine, because those strings are always terminated.

Worth noting that H5Dread_string in the same source tree already handles this correctly
for the same kind of field, by copying out the element's own bytes and terminating the
copy itself.

For the file PacketTableIssue.h5 at /rec/Events, where each member is a variable-length
sequence of one byte strings. h5dump shows ("I","n","i","t",...):

before:  [Initialize, nitialize, itialize, tialize, ialize, alize, lize, ize, ze]
after:   [I, n, i, t, i, a, l, i, z]

It also crosses member boundaries. A compound of {tag: 2 byte string, id: int, note: 4 byte string} with tag holding exactly ab and id given printable bytes:

before:  [abAAAAxy, 1094795585, xy]
after:   [ab, 1094795585, xy]

The two byte tag swallowed the int member and the string member after it. note is
unaffected because it is shorter than its field, so its padding still terminates it.

Origin

This is not a regression in HDFView. The unbounded read is present unchanged at the hdf5_2.0.0 release tag, which is what HDFView 3.4.1 shipped against, and on current develop.

Likely fix in HDF5

Copy at most the element's own bytes into a buffer, terminate the copy, and convert that,
which is what H5Dread_string already does.

Note that a Java side workaround would only correct the displayed value. The out of bounds
read itself happens in native code and can only be fixed there.

Affected HDFView test files

The defect only reaches HDFView through H5DreadVL, which in practice means a fixed-length
string sitting inside a variable-length type.

A fixed-length string that holds no
variable-length data is read with plain H5Dread into a byte array and converted by
Dataset.byteToString, which takes exactly the field's bytes with
new String(bytes, i * length, length) and trims at the first terminator. That is bounded,
so the library's unbounded read is never reached.

object/src/test/java/object/TestNestedDatatypeShapes.testVlenOfFixedString is already disabled and waiting for a JNI fix.

testArrayOfFixedString beside it is unaffected, because an array of fixed-length strings
contains no variable-length data and takes the flat path.

Next Steps for HDFView

The condition is detectable from the datatype, so HDFView can avoid rendering potentially incorrect values until a fix gets into the JNI itself. Once a JNI patch gets in, this can be removed.

Lenguaje dominante
Java
Estrellas
157
Forks
28
Merge medio
16 h 22 min
PR fusionados (30 d)
12

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de HDFGroup/hdfview

Todos los issues de HDFGroup/hdfview

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.