Local process crash via unchecked address-length decode

Heap buffer overflow in HDF5 1.14.0 through 1.14.6 allows local users to crash a consuming process with a crafted HDF5 file. H5F_addr_decode_len trusts addr_len and advances its input pointer while decoding bytes without verifying that the heap buffer contains that length. Exploitation requires a local user to cause an application to open the crafted file; the public reproducer demonstrates an out-of-bounds read and process termination, not code execution.