[svn-r20061] Description:

    Bring changes from Coverity branch to trunk:

r19930:
Fix memory leaks involving VL attributes in h5repack and h5diff.  The buffers in
copy_attr and diff_attr were not checked for the presence of a vlen before being
freed, and vlen storage was never reclaimed.  Added checks and calls to
H5D_vlen_reclaim().

r19933:
Purpose: Fix memory leak in H5L_move_cb()

Description: H5L_move_cb copied the source link using H5O_msg_copy() but freed
it manually using H5MM_xfree().  Since H5O_link_copy allocates the link using
H5FL_MALLOC, this causes the link to be allocated from the free list but is
never put back on the free list when it is freed.  This prevents the link free
list from shutting down properly.  Modified H5L_move_cb() and H5L_move_dest_cb()
to free the link properly using H5O_msg_free().

r19973:
Fix resource leaks by freeing string created by HD5f2string

r19974:
Issue #345: Inialize buf variable to null

Tested on:
    Mac OS X/32 10.6.6 (amazon) w/debug & production
    (h5committested on Coverity branch)

1 files changed, 11 insertions, 12 deletions

diff --git a/src/H5L.c b/src/H5L.c
index 9319e2c..2a9d591 100644
--- a/src/H5L.c
+++ b/src/H5L.c
@@ -2414,8 +2414,8 @@ H5L_move_dest_cb(H5G_loc_t *grp_loc/*in*/, const char *name,
     H5G_own_loc_t *own_loc/*out*/)
 {
     H5L_trav_mv2_t *udata = (H5L_trav_mv2_t *)_udata;   /* User data passed in */
-    H5G_t *grp=NULL;                    /* H5G_t for this group, opened to pass to user callback */
-    hid_t grp_id = FAIL;                /* Id for this group (passed to user callback */
+    H5G_t *grp = NULL;                  /* H5G_t for this group, opened to pass to user callback */
+    hid_t grp_id = FAIL;                /* ID for this group (passed to user callback */
     H5G_loc_t temp_loc;                 /* For UD callback */
     hbool_t temp_loc_init = FALSE;
     herr_t ret_value = SUCCEED;         /* Return value */
@@ -2500,6 +2500,10 @@ done:
      * location for the object */
     *own_loc = H5G_OWN_NONE;
 
+    /* Reset the "name" field in udata->lnk because it is owned by traverse()
+     * and must not be manipulated after traverse closes */
+    udata->lnk->name = NULL;
+
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5L_move_dest_cb() */
 
@@ -2539,7 +2543,7 @@ H5L_move_cb(H5G_loc_t *grp_loc/*in*/, const char *name, const H5O_link_t *lnk,
         HGOTO_ERROR(H5E_SYM, H5E_NOTFOUND, FAIL, "the name of a link must be supplied to move or copy")
 
     /* Set up user data for move_dest_cb */
-    if((udata_out.lnk = (H5O_link_t *)H5O_msg_copy(H5O_LINK_ID, lnk, NULL)) == NULL)
+    if(NULL == (udata_out.lnk = (H5O_link_t *)H5O_msg_copy(H5O_LINK_ID, lnk, NULL)))
         HGOTO_ERROR(H5E_LINK, H5E_CANTCOPY, FAIL, "unable to copy link to be moved")
 
     /* In this special case, the link's name is going to be replaced at its
@@ -2600,16 +2604,11 @@ done:
         H5MM_xfree(orig_name);
 
     /* If udata_out.lnk was copied, free any memory allocated
-     * In this special case, the H5L_move_dest_cb callback frees the name
-     * if it succeeds
+     * In this special case, the H5L_move_dest_cb callback resets the name
+     * so H5O_msg_free shouldn't try to free it
      */
-    if(link_copied) {
-        if(udata_out.lnk->type == H5L_TYPE_SOFT)
-            udata_out.lnk->u.soft.name = (char *)H5MM_xfree(udata_out.lnk->u.soft.name);
-        else if(udata_out.lnk->type >= H5L_TYPE_UD_MIN && udata_out.lnk->u.ud.size > 0)
-            udata_out.lnk->u.ud.udata = H5MM_xfree(udata_out.lnk->u.ud.udata);
-        H5MM_xfree(udata_out.lnk);
-    } /* end if */
+    if(link_copied)
+        H5O_msg_free(H5O_LINK_ID, udata_out.lnk);
 
     /* Indicate that this callback didn't take ownership of the group *
      * location for the object */