[svn-r15232] Description:

	Bring back revisions 14700:14800 from the trunk

Tested on:
        FreeBSD/32 6.2 (duty) in debug mode
        FreeBSD/64 6.2 (liberty) w/C++ & FORTRAN, in debug mode
        Linux/32 2.6 (kagiso) w/PGI compilers, w/C++ & FORTRAN, w/threadsafe,
                                in debug mode
        Linux/64-amd64 2.6 (smirom) w/default API=1.6.x, w/C++ & FORTRAN,
                                in production mode
        Linux/64-ia64 2.6 (cobalt) w/Intel compilers, w/C++ & FORTRAN,
                                in production mode
        Solaris/32 2.10 (linew) w/deprecated symbols disabled, w/C++ & FORTRAN,
                                w/szip filter, in production mode
        Mac OS X/32 10.5.2 (amazon) in debug mode
        Linux/64-ia64 2.4 (tg-login3) w/parallel, w/FORTRAN, in production mode

1 files changed, 16 insertions, 3 deletions

diff --git a/src/H5Odtype.c b/src/H5Odtype.c
index ac07edf..ba343bc 100644
--- a/src/H5Odtype.c
+++ b/src/H5Odtype.c
@@ -232,10 +232,11 @@ H5O_dtype_decode_helper(H5F_t *f, const uint8_t **pp, H5T_t *dt)
         case H5T_COMPOUND:
             {
                 unsigned offset_nbytes;         /* Size needed to encode member offsets */
+                size_t max_memb_pos = 0;        /* Maximum member covered, so far */
                 unsigned j;
 
                 /* Compute the # of bytes required to store a member offset */
-                offset_nbytes = (H5V_log2_gen((uint64_t)dt->shared->size) + 7) / 8;
+                offset_nbytes = H5V_limit_enc_size((uint64_t)dt->shared->size);
 
                 /*
                  * Compound datatypes...
@@ -336,6 +337,18 @@ H5O_dtype_decode_helper(H5F_t *f, const uint8_t **pp, H5T_t *dt)
                     /* Set the field datatype (finally :-) */
                     dt->shared->u.compnd.memb[i].type = temp_type;
 
+                    /* Check if this field overlaps with a prior field */
+                    /* (probably indicates that the file is corrupt) */
+                    if(i > 0 && dt->shared->u.compnd.memb[i].offset < max_memb_pos) {
+                        for(j = 0; j < i; j++)
+                            if(dt->shared->u.compnd.memb[i].offset >= dt->shared->u.compnd.memb[j].offset
+                                    && dt->shared->u.compnd.memb[i].offset < (dt->shared->u.compnd.memb[j].offset + dt->shared->u.compnd.memb[j].size))
+                                HGOTO_ERROR(H5E_DATATYPE, H5E_CANTDECODE, FAIL, "member overlaps with previous member")
+                    } /* end if */
+
+                    /* Update the maximum member position covered */
+                    max_memb_pos = MAX(max_memb_pos, (dt->shared->u.compnd.memb[i].offset + dt->shared->u.compnd.memb[i].size));
+
                     /* Check if the datatype stayed packed */
                     if(dt->shared->u.compnd.packed) {
                         /* Check if the member type is packed */
@@ -734,7 +747,7 @@ H5O_dtype_encode_helper(const H5F_t *f, uint8_t **pp, const H5T_t *dt)
                 unsigned offset_nbytes;         /* Size needed to encode member offsets */
 
                 /* Compute the # of bytes required to store a member offset */
-                offset_nbytes = (H5V_log2_gen((uint64_t)dt->shared->size) + 7) / 8;
+                offset_nbytes = H5V_limit_enc_size((uint64_t)dt->shared->size);
 
                 /*
                  * Compound datatypes...
@@ -1097,7 +1110,7 @@ H5O_dtype_size(const H5F_t *f, const void *_mesg)
                 unsigned offset_nbytes;         /* Size needed to encode member offsets */
 
                 /* Compute the # of bytes required to store a member offset */
-                offset_nbytes = (H5V_log2_gen((uint64_t)dt->shared->size) + 7) / 8;
+                offset_nbytes = H5V_limit_enc_size((uint64_t)dt->shared->size);
 
                 /* Compute the total size needed to encode compound datatype */
                 for(u = 0; u < dt->shared->u.compnd.nmembs; u++) {