Fix for HDFFV-10216 segfault in H5G_node_cmp3 with corrupt h5 file

Fix H5HL_offset_into() to return error when offset exceeds heap data block size.
Also fix other places that call this routine to detect error return.

1 files changed, 11 insertions, 5 deletions

diff --git a/src/H5Gstab.c b/src/H5Gstab.c
index a239cfe..7750671 100644
--- a/src/H5Gstab.c
+++ b/src/H5Gstab.c
@@ -707,11 +707,12 @@ done:
 static herr_t
 H5G_stab_get_name_by_idx_cb(const H5G_entry_t *ent, void *_udata)
 {
-    H5G_bt_it_gnbi_t	*udata = (H5G_bt_it_gnbi_t *)_udata;
+    H5G_bt_it_gnbi_t    *udata = (H5G_bt_it_gnbi_t *)_udata;
     size_t name_off;                    /* Offset of name in heap */
     const char *name;                   /* Pointer to name string in heap */
+    herr_t ret_value = SUCCEED;         /* Return value */
 
-    FUNC_ENTER_NOAPI_NOINIT_NOERR
+    FUNC_ENTER_NOAPI_NOINIT
 
     /* Sanity check */
     HDassert(ent);
@@ -719,12 +720,16 @@ H5G_stab_get_name_by_idx_cb(const H5G_entry_t *ent, void *_udata)
 
     /* Get name offset in heap */
     name_off = ent->name_off;
-    name = (const char *)H5HL_offset_into(udata->heap, name_off);
+
+    if((name = (const char *)H5HL_offset_into(udata->heap, name_off)) == NULL)
+        HGOTO_ERROR(H5E_SYM, H5E_CANTGET, FAIL, "unable to get symbol table link name")
+
     HDassert(name);
     udata->name = H5MM_strdup(name);
     HDassert(udata->name);
 
-    FUNC_LEAVE_NOAPI(SUCCEED)
+done:
+    FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5G_stab_get_name_by_idx_cb */
 
 
@@ -941,7 +946,8 @@ H5G_stab_lookup_by_idx_cb(const H5G_entry_t *ent, void *_udata)
     HDassert(udata && udata->heap);
 
     /* Get a pointer to the link name */
-    name = (const char *)H5HL_offset_into(udata->heap, ent->name_off);
+    if((name = (const char *)H5HL_offset_into(udata->heap, ent->name_off)) == NULL)
+        HGOTO_ERROR(H5E_SYM, H5E_CANTGET, FAIL, "unable to get symbol table link name")
     HDassert(name);
 
     /* Convert the entry to a link */