You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

PoC: integer overflow in NetCDF attribute length → undersized xvalue + huge nelems → OOB read (CWE-190/125)

Calling nc_get_att_* on an attribute of a crafted CDF-5 NetCDF file (.nc) reads out of bounds: the attribute value buffer is allocated with an overflow-wrapped size while the element count is stored at its huge original value, so the read loop runs far past the buffer.

Root cause

libsrc/ncx.h:142 ncx_len_int(nelems) = (nelems) * X_SIZEOF_INT — no overflow guard.
libsrc/attr.m4 new_x_NC_attr: xsz = ncx_len_NC_attrV(type, nelems) (wraps small), allocates an xsz-byte xvalue, but stores attrp->nelems = nelems (the huge original) separately.
libsrc/attr.m4 NC3_get_att: ncx_pad_getn_Iint(&xp, attrp->nelems, value) passes the huge nelems.
libsrc/ncx.m4 NCX_GETN: for( ; nelems != 0; nelems--, xp += 4) tp[i] = get_int(xp); reads nelems ints from xvalue.

For CDF-5, v1h_get_size_t reads the attribute element count as a full uint64. With nelems = SIZE_MAX/4 + 2, ncx_len_int wraps to a tiny value (4), so xvalue is 4 bytes but attrp->nelems is ~4.6e18. The file read (v1h_get_NC_attrV) copies only xsz bytes (no OOB write), but a later nc_get_att_int() reads attrp->nelems ints from the 4-byte xvalue → heap OOB read. Unlike the dim/var array case, the allocation size (wrapped) and the read count (huge, stored separately) diverge. Reachable via nc_open() + nc_get_att_int() on a crafted CDF-5 file.

Reproduce (AddressSanitizer)

g++ -fsanitize=address -g -O0 netcdf_attr_value_oob_read_harness.cpp -o poc && ./poc
# nelems = 4611686018427387905 ; ncx_len_int(nelems) = xsz = 4 (wrapped!)
# xvalue allocated = 4 bytes; nc_get_att_int will read attrp->nelems = 4611686018427387905 ints...
# ==ERROR: AddressSanitizer: heap-buffer-overflow  READ of size 4 ... 0 bytes after the 4-byte region

Fix

Guard ncx_len_* (and new_x_NC_attr) against nelems * itemsize overflow (e.g. reject nelems > SIZE_MAX / itemsize), mirroring the SIZE_MAX / sizeof(...) checks the dim/var array parsers use.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support