Skip to content

size b2nd shape buffers to B2ND_MAX_DIM in ndmean and ndlz#783

Closed
alhudz wants to merge 1 commit into
Blosc:mainfrom
alhudz:b2nd-shape-maxdim
Closed

size b2nd shape buffers to B2ND_MAX_DIM in ndmean and ndlz#783
alhudz wants to merge 1 commit into
Blosc:mainfrom
alhudz:b2nd-shape-maxdim

Conversation

@alhudz

@alhudz alhudz commented Jun 6, 2026

Copy link
Copy Markdown

Repro: store a b2nd array whose metalayer declares ndim in 9..16, with the ndmean filter (or the ndlz codec), then read it back. ASAN reports a heap write past the shape/chunkshape/blockshape buffers in b2nd_deserialize_meta.
Cause: ndmean_forward/ndmean_backward and ndlz4_compress/ndlz8_compress allocate those buffers with 8 slots, but b2nd_deserialize_meta fills up to B2ND_MAX_DIM (16) entries straight from the metalayer. ndmean then indexes its NDMEAN_MAX_DIM stack arrays with the same unchecked ndim.
Fix: size the buffers to B2ND_MAX_DIM, as ndcell and the zfp codec already do, and reject ndim outside 1..NDMEAN_MAX_DIM in ndmean the way ndcell does.

@FrancescAlted

Copy link
Copy Markdown
Member

Already addressed in #781.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants