summaryrefslogtreecommitdiffstats
path: root/src/H5Ofill.c
diff options
context:
space:
mode:
authorVailin Choi <vchoi@jam.ad.hdfgroup.org>2018-07-11 03:00:14 (GMT)
committerM. Scot Breitenfeld <brtnfld@hdfgroup.org>2018-07-26 22:16:50 (GMT)
commit78d4fbddbd20904f9ee05a1d5de3ddd701453d24 (patch)
treed0f9cf6e29233f55b1e4f9f40e986de61b5872f4 /src/H5Ofill.c
parent256f74f5320a5a97fc396b942c7d54331740244d (diff)
downloadhdf5-78d4fbddbd20904f9ee05a1d5de3ddd701453d24.zip
hdf5-78d4fbddbd20904f9ee05a1d5de3ddd701453d24.tar.gz
hdf5-78d4fbddbd20904f9ee05a1d5de3ddd701453d24.tar.bz2
Fix for HDFFV-10333:
1) Check for valid object header version for a refcount messge 2) Check for invalid fill value size 3) Check for invalid dimension size in a layout message 4) Add --enable-error-stack option to h5stat 5) Add error checks to h5stat.c 6) Add tests to h5stat and h5dump
Diffstat (limited to 'src/H5Ofill.c')
-rw-r--r--src/H5Ofill.c22
1 files changed, 21 insertions, 1 deletions
diff --git a/src/H5Ofill.c b/src/H5Ofill.c
index 932241f..3ce2e4f 100644
--- a/src/H5Ofill.c
+++ b/src/H5Ofill.c
@@ -19,6 +19,7 @@
*/
#include "H5Omodule.h" /* This source code file is part of the H5O module */
+#define H5T_FRIEND /*prevent warning from including H5Tpkg */
#include "H5private.h" /* Generic Functions */
@@ -31,6 +32,7 @@
#include "H5Pprivate.h" /* Property lists */
#include "H5Sprivate.h" /* Dataspaces */
+#include "H5Tpkg.h" /* Datatypes */
static void *H5O_fill_old_decode(H5F_t *f, H5O_t *open_oh, unsigned mesg_flags,
unsigned *ioflags, size_t p_size, const uint8_t *p);
@@ -307,11 +309,13 @@ done:
*-------------------------------------------------------------------------
*/
static void *
-H5O_fill_old_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
+H5O_fill_old_decode(H5F_t *f, H5O_t *open_oh,
unsigned H5_ATTR_UNUSED mesg_flags, unsigned H5_ATTR_UNUSED *ioflags,
size_t H5_ATTR_UNUSED p_size, const uint8_t *p)
{
H5O_fill_t *fill = NULL; /* Decoded fill value message */
+ htri_t exists = FALSE;
+ H5T_t *dt = NULL;
void *ret_value = NULL; /* Return value */
FUNC_ENTER_NOAPI_NOINIT
@@ -332,6 +336,19 @@ H5O_fill_old_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
/* Only decode the fill value itself if there is one */
if(fill->size > 0) {
+ H5_CHECK_OVERFLOW(fill->size, ssize_t, size_t);
+
+ /* Get the datatype message */
+ if((exists = H5O_msg_exists_oh(open_oh, H5O_DTYPE_ID)) < 0)
+ HGOTO_ERROR(H5E_SYM, H5E_NOTFOUND, NULL, "unable to read object header")
+ if(exists) {
+ if((dt = H5O_msg_read_oh(f, open_oh, H5O_DTYPE_ID, NULL)) < 0)
+ HGOTO_ERROR(H5E_SYM, H5E_CANTGET, NULL, "can't read DTYPE message")
+ /* Verify size */
+ if(fill->size != dt->shared->size)
+ HGOTO_ERROR(H5E_SYM, H5E_CANTGET, NULL, "inconsistent fill value size")
+ }
+
if(NULL == (fill->buf = H5MM_malloc((size_t)fill->size)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for fill value")
HDmemcpy(fill->buf, p, (size_t)fill->size);
@@ -344,6 +361,9 @@ H5O_fill_old_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
ret_value = (void*)fill;
done:
+ if(dt)
+ H5O_msg_free(H5O_DTYPE_ID, dt);
+
if(!ret_value && fill) {
if(fill->buf)
H5MM_xfree(fill->buf);