[svn-r2508] Purpose:

    Bug fixes
Description:
    All tests were core=dumping in IRIX64.  The bug is in Generic
    property list creation in which malloc asked for 2*64-1 bytes
    due to coding bug.  The object creation failed but the return
    code was not checked.  Program eventually crashed.
Solution:
H5F.c:
    Check the return code from new file object creation and flag
    error accordingly.
H5FL.c:
    H5FL_arr_free is a replacement for H5MM_xfree which accepts
    null value as a legal argument value.  H5FL_arr_free assert
    on it.  Since other parts of the code have been passing null
    value to H5MM_xfree, H5FL_arr_free must accept it too until
    all the calling routines are changed to not pass Null.
H5P.c:
    some routine passes in 0 as the hashsize value which is uintn.
    The expression (hashsize-1) underflows to the largest unsigned
    int for some machines.  Thus the calloc failed.  Cast hashsize
    to unsigned int first (this assumes hashsize stays within the
    signed int data range.
H5Smpio.c:
    Added the extra parameter because the H5FD_write has been redefined.

Platforms tested:
    IRIX64 -64 and -n32

4 files changed, 17 insertions, 9 deletions

diff --git a/src/H5F.c b/src/H5F.c
index 948d0b8..9559963 100644
--- a/src/H5F.c
+++ b/src/H5F.c
@@ -1055,7 +1055,9 @@ H5F_open(const char *name, uintn flags, hid_t fcpl_id, hid_t fapl_id)
 	    HGOTO_ERROR(H5E_FILE, H5E_CANTOPENFILE, NULL,
 			"unable to open file");
 	}
-	file = H5F_new(NULL, fcpl_id, fapl_id);
+	if (NULL==(file = H5F_new(NULL, fcpl_id, fapl_id)))
+	    HGOTO_ERROR(H5E_FILE, H5E_CANTOPENFILE, NULL,
+			"unable to create new file object");
 	file->shared->flags = flags;
 	file->shared->lf = lf;
     } else {
@@ -1063,7 +1065,9 @@ H5F_open(const char *name, uintn flags, hid_t fcpl_id, hid_t fapl_id)
 	 * This file is not yet open by the library and our tentative opening
 	 * above is good enough.
 	 */
-	file = H5F_new(NULL, fcpl_id, fapl_id);
+	if (NULL==(file = H5F_new(NULL, fcpl_id, fapl_id)))
+	    HGOTO_ERROR(H5E_FILE, H5E_CANTOPENFILE, NULL,
+			"unable to create new file object");
 	file->shared->flags = flags;
 	file->shared->lf = lf;
     }
diff --git a/src/H5FL.c b/src/H5FL.c
index 897e98a..701a6d9 100644
--- a/src/H5FL.c
+++ b/src/H5FL.c
@@ -1144,13 +1144,15 @@ H5FL_arr_free(H5FL_arr_head_t *head, void *obj)
 
     FUNC_ENTER (H5FL_arr_free, NULL);
 
-    /* Double check parameters */
-    assert(head);
-    assert(obj);
-
 #ifdef NO_ARR_FREE_LISTS
     H5MM_xfree(obj);
 #else /* NO_ARR_FREE_LISTS */
+    /* The H5MM_xfree code allows obj to null */
+    if (!obj) return (NULL);
+
+    /* Double check parameters */
+    assert(head);
+
     /* Make certain that the free list is initialized */
     assert(head->init);
 
diff --git a/src/H5P.c b/src/H5P.c
index c60ad6c..1e985d6 100644
--- a/src/H5P.c
+++ b/src/H5P.c
@@ -3385,7 +3385,9 @@ H5P_create_class(H5P_genclass_t *par_class, const char *name, uintn hashsize, ui
     }
 
     /* Allocate room for the class & it's hash table of properties */
-    if (NULL==(pclass = H5MM_calloc (sizeof(H5P_genclass_t)+((hashsize-1)*sizeof(H5P_genprop_t *)))))
+    /* Need to (intn) hashsize so that (hashsize-1) can be negative since hashsize can be 0. */
+    if (NULL==(pclass = H5MM_calloc (sizeof(H5P_genclass_t)+
+		((((intn)hashsize)-1)*sizeof(H5P_genprop_t *)))))
         HGOTO_ERROR (H5E_RESOURCE, H5E_NOSPACE, NULL,"memory allocation failed");
 
     /* Set class state */
@@ -3540,7 +3542,7 @@ H5P_genplist_t *H5P_create_list(H5P_genclass_t *class)
      */
 
     /* Allocate room for the property list & it's hash table of properties */
-    if (NULL==(plist = H5MM_calloc (sizeof(H5P_genplist_t)+((class->hashsize-1)*sizeof(H5P_genprop_t *)))))
+    if (NULL==(plist = H5MM_calloc (sizeof(H5P_genplist_t)+(((intn)(class->hashsize)-1)*sizeof(H5P_genprop_t *)))))
         HGOTO_ERROR (H5E_RESOURCE, H5E_NOSPACE, NULL,"memory allocation failed");
 
     /* Set class state */
diff --git a/src/H5Smpio.c b/src/H5Smpio.c
index 185bcdc..87ecd30 100644
--- a/src/H5Smpio.c
+++ b/src/H5Smpio.c
@@ -594,7 +594,7 @@ H5S_mpio_spaces_xfer(H5F_t *f, const struct H5O_layout_t *layout,
 		      "transfer size overflows size_t");
     }
     if (do_write) {
-    	err = H5FD_write(f->shared->lf, dxpl_id, addr, mpi_count, buf);
+    	err = H5FD_write(f->shared->lf, H5FD_MEM_DRAW, dxpl_id, addr, mpi_count, buf);
     	if (err) {
 	    HRETURN_ERROR(H5E_IO, H5E_WRITEERROR, FAIL,"MPI write failed");
 	}