Fixed-length strings read past the end of their field

Aperta
  • Qualcosa non va?
#504 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@mattjala ci sta già lavorando.

Dal 13/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

Component - Object Library

A fixed-length string only carries a terminator when its field is longer than the text it
holds. The HDF5 JNI reads these strings by handing the raw element address to
NewStringUTF, which reads until it finds a terminator, so a string that fills its field
runs on into whatever follows it. HDFView displays those neighbouring bytes as part of the
value wherever it reads the string through H5DreadVL.

The data is already wrong when it crosses the JNI boundary, so HDFView cannot fix the
values. It can detect the condition, which is covered at the end.

Root cause

java/src-jni/jni/h5util.c in the HDF5 source, the H5T_STRING case of
translate_atomic_rbuf:

else {
    if (NULL == (jobj = ENVPTR->NewStringUTF(ENVONLY, char_buf))) {

char_buf points at the element. Nothing bounds the read to the element's size. The
variable-length branch just above it is fine, because those strings are always terminated.

Worth noting that H5Dread_string in the same source tree already handles this correctly
for the same kind of field, by copying out the element's own bytes and terminating the
copy itself.

For the file PacketTableIssue.h5 at /rec/Events, where each member is a variable-length
sequence of one byte strings. h5dump shows ("I","n","i","t",...):

before:  [Initialize, nitialize, itialize, tialize, ialize, alize, lize, ize, ze]
after:   [I, n, i, t, i, a, l, i, z]

It also crosses member boundaries. A compound of {tag: 2 byte string, id: int, note: 4 byte string} with tag holding exactly ab and id given printable bytes:

before:  [abAAAAxy, 1094795585, xy]
after:   [ab, 1094795585, xy]

The two byte tag swallowed the int member and the string member after it. note is
unaffected because it is shorter than its field, so its padding still terminates it.

Origin

This is not a regression in HDFView. The unbounded read is present unchanged at the hdf5_2.0.0 release tag, which is what HDFView 3.4.1 shipped against, and on current develop.

Likely fix in HDF5

Copy at most the element's own bytes into a buffer, terminate the copy, and convert that,
which is what H5Dread_string already does.

Note that a Java side workaround would only correct the displayed value. The out of bounds
read itself happens in native code and can only be fixed there.

Affected HDFView test files

The defect only reaches HDFView through H5DreadVL, which in practice means a fixed-length
string sitting inside a variable-length type.

A fixed-length string that holds no
variable-length data is read with plain H5Dread into a byte array and converted by
Dataset.byteToString, which takes exactly the field's bytes with
new String(bytes, i * length, length) and trims at the first terminator. That is bounded,
so the library's unbounded read is never reached.

object/src/test/java/object/TestNestedDatatypeShapes.testVlenOfFixedString is already disabled and waiting for a JNI fix.

testArrayOfFixedString beside it is unaffected, because an array of fixed-length strings
contains no variable-length data and takes the flat path.

Next Steps for HDFView

The condition is detectable from the datatype, so HDFView can avoid rendering potentially incorrect values until a fix gets into the JNI itself. Once a JNI patch gets in, this can be removed.

Lingua principale
Java
Stelle
157
Fork
28
Merge medio
16h 22m
PR unite (30g)
12

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di HDFGroup/hdfview

Tutte le issue di HDFGroup/hdfview

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.