CVE-2019-20016

Vulnerability

libmysofa before the 2019-11-24 commit lacks a recursion depth limit in the HDF parsing routines. Specifically, the functions readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c can call themselves recursively without bound when processing a crafted HDF file [1][2]. This leads to stack exhaustion. The issue affects all versions prior to the fix, including v0.8.

Exploitation

An attacker can trigger the vulnerability by supplying a malicious HDF file to any application that uses libmysofa to parse it, such as the mysofa2json utility. No authentication or special privileges are required; the file is simply opened and parsed. The recursive calls cause the stack to grow until a segmentation fault occurs, as demonstrated by AddressSanitizer stack-overflow reports [1][2].

Impact

Successful exploitation results in a denial-of-service condition: the application crashes due to stack overflow. There is no evidence in the available references of arbitrary code execution or information disclosure; the impact is limited to availability.

Mitigation

The fix was introduced in commit 2e6fac6 [3], which adds a recursive_counter field to the READER structure and limits recursion to 10 levels. According to the CVE description, a download of version 0.9 after 2019-12-06 should fully remediate the issue. Users should update to the latest version. No workaround is documented.