Fix heap buffer overflow in NDCELL decompression path by saddamr3e · Pull Request #785 · Blosc/c-blosc2

saddamr3e · 2026-06-11T10:38:34Z

Fix a heap buffer overflow in the NDCELL filter caused by insufficient validation of block geometry embedded in the attacker-controlled b2nd metalayer.

Root Cause

ndcell_forward() and ndcell_backward() computed:

int32_t blocksize = (int32_t) typesize;
for (i = 0; i < ndim; i++) {
    blocksize *= blockshape[i];
}

using 32-bit arithmetic. A crafted blockshape could cause the product to wrap around and match the supplied block length, allowing malformed metadata to bypass validation.

Subsequent index calculations used the actual block dimensions, which could lead to out-of-bounds memory accesses during filter processing.

Fix

Compute block size using int64_t.
Reject non-positive typesize values.
Reject non-positive blockshape dimensions.
Abort processing when the running product exceeds the block length.
Update validation checks to compare against the 64-bit block size.

Tests

Added a dedicated regression test covering:

Blockshape values whose 32-bit product wraps onto the supplied block length.
Zero block dimensions.
Negative block dimensions.

Copilot

Pull request overview

Hardens the NDCELL filter’s decompression (and compression) paths against attacker-controlled b2nd metalayer geometry by preventing 32-bit overflow/wraparound in block-size validation, and adds a regression test to prevent reintroducing the issue.

Changes:

Compute and validate blocksize using 64-bit arithmetic and reject invalid typesize / blockshape values early.
Add a regression test that exercises wraparound and invalid blockshape dimensions.
Wire the new regression test into the NDCELL plugin CMake/CTest targets.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
plugins/filters/ndcell/ndcell.c	Adds 64-bit blocksize validation and stricter geometry checks in forward/backward paths.
plugins/filters/ndcell/test_ndcell_oversized_blockshape.c	Introduces a regression test targeting oversized/wrapping and invalid blockshape metadata.
plugins/filters/ndcell/CMakeLists.txt	Builds and registers the new regression test with CTest.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

saddamr3e · 2026-06-16T06:25:53Z

  int8_t cell_shape = (int8_t) meta;
  const int cell_size = (int) pow(cell_shape, ndim);


Changed int8_t cell_shape = (int8_t) meta; to int cell_shape = (int) meta; and added a cell_shape <= 0 guard before pow()/division. meta is a uint8_t (0–255); the old int8_t cast made 0 a divide-by-zero in (blockshape[i] + cell_shape - 1) / cell_shape and turned 128–255 into negative geometry.

saddamr3e · 2026-06-16T06:26:11Z

@@ -188,12 +212,42 @@ int ndcell_backward(const uint8_t *input, uint8_t *output, int32_t length, uint8
  uint8_t *ip = (uint8_t *) input;
  uint8_t *ip_limit = ip + length;


Same fix on the attacker-controlled decompression path, placed before cell_size/division use.

saddamr3e · 2026-06-16T06:26:41Z

+  uint8_t *input  = calloc(1, (size_t) (length > 0 ? length : 1));
+  uint8_t *output = malloc((size_t) (length > 0 ? length : 1));
+
+  int rc = ndcell_backward(input, output, length, cell_shape, &dparams, 0);
+
+  free(input);
+  free(output);
+  blosc2_schunk_free(schunk);


"Length not equal to blocksize" now logs both values: "...%d %lld", length, (long long) blocksize, matching the forward path.

saddamr3e · 2026-06-16T06:27:50Z

+  if ((int64_t) length != blocksize) {
    free(shape);
    free(chunkshape);
    free(blockshape);


Added a 64-byte 0xAC canary immediately after the output buffer and a post-call check, so a partial scatter-write that precedes the error return is caught — not just the return code. Added <string.h> for memset.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

saddamr3e · 2026-06-16T18:17:02Z

+  // `meta` is the cell side length and comes from the chunk header (uint8_t,
+  // 0..255).  Interpret it as unsigned and reject 0: an (int8_t) cast would turn
+  // 128..255 into negative values and 0 would later divide by zero in
+  // `(blockshape[i] + cell_shape - 1) / cell_shape`.
+  int cell_shape = (int) meta;
+  if (cell_shape <= 0) {
+    free(shape);
+    free(chunkshape);
+    free(blockshape);
+    BLOSC_TRACE_ERROR("Invalid cell_shape %d", cell_shape);
+    return BLOSC2_ERROR_FAILURE;
+  }
  const int cell_size = (int) pow(cell_shape, ndim);


Fixed. cell_size is now int64_t, computed with checked multiplication that bails with BLOSC2_ERROR_FAILURE if the running product would exceed INT64_MAX — no more (int) pow() overflow/UB. The downstream guard is now cell_size > (int64_t) length / typesize, which can't overflow.

saddamr3e · 2026-06-16T18:17:37Z

+  // `meta` is attacker-controlled in a crafted frame.  Interpret it as unsigned
+  // and reject 0: an (int8_t) cast would turn 128..255 into negative values and
+  // 0 would later divide by zero in `(blockshape[i] + cell_shape - 1) / cell_shape`.
+  int cell_shape = (int) meta;
+  if (cell_shape <= 0) {
+    free(shape);
+    free(chunkshape);
+    free(blockshape);
+    BLOSC_TRACE_ERROR("Invalid cell_shape %d", cell_shape);
+    return BLOSC2_ERROR_FAILURE;
+  }
  int cell_size = (int) pow(cell_shape, ndim);
  int32_t typesize = schunk->typesize;


Same fix applied here on the decompression path. Since meta is attacker-controlled, this matters more — checked 64-bit multiply rejects oversized cell_shape^ndim before it can bypass the buffer-size check, and the check itself is overflow-safe (length == blocksize guarantees the division is exact).

saddamr3e · 2026-06-16T18:17:46Z

+int ndcell_backward(const uint8_t *input, uint8_t *output, int32_t length, uint8_t meta,
+                    blosc2_dparams *dparams, uint8_t id);


Removed. ndcell.h is already included and declares ndcell_backward, so I dropped the local prototype to avoid signature drift.

FrancescAlted · 2026-06-17T09:00:11Z

LGTM. Thanks @saddamr3e !

Fix heap buffer overflow in NDCELL decompression path

6c024c3

FrancescAlted requested a review from Copilot June 14, 2026 07:53

Copilot started reviewing on behalf of FrancescAlted June 14, 2026 07:53 View session

Copilot AI reviewed Jun 14, 2026

View reviewed changes

updated

d7bac6d

FrancescAlted requested a review from Copilot June 16, 2026 08:21

Copilot started reviewing on behalf of FrancescAlted June 16, 2026 08:21 View session

Copilot AI reviewed Jun 16, 2026

View reviewed changes

updated

5cd6eae

FrancescAlted merged commit dfec5bc into Blosc:main Jun 17, 2026
18 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix heap buffer overflow in NDCELL decompression path#785

Fix heap buffer overflow in NDCELL decompression path#785
FrancescAlted merged 3 commits into
Blosc:mainfrom
saddamr3e:ndcell-blockshape-validation

saddamr3e commented Jun 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

saddamr3e Jun 16, 2026

Uh oh!

saddamr3e Jun 16, 2026

Uh oh!

saddamr3e Jun 16, 2026

Uh oh!

saddamr3e Jun 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

saddamr3e Jun 16, 2026

Uh oh!

saddamr3e Jun 16, 2026

Uh oh!

saddamr3e Jun 16, 2026

Uh oh!

FrancescAlted commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		int8_t cell_shape = (int8_t) meta;
		const int cell_size = (int) pow(cell_shape, ndim);

		@@ -188,12 +212,42 @@ int ndcell_backward(const uint8_t input, uint8_t output, int32_t length, uint8
		uint8_t ip = (uint8_t ) input;
		uint8_t *ip_limit = ip + length;

		int ndcell_backward(const uint8_t input, uint8_t output, int32_t length, uint8_t meta,
		blosc2_dparams *dparams, uint8_t id);

Uh oh!

Conversation

saddamr3e commented Jun 11, 2026

Root Cause

Fix

Tests

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

saddamr3e Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

saddamr3e Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

saddamr3e Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

saddamr3e Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

saddamr3e Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

saddamr3e Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

saddamr3e Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

FrancescAlted commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants