[svn-r4736] Purpose:

    Bug Fix
Description:
    H5Tinsert was allowing compound datatype fields to be inserted past the end
    of the datatype.
Solution:
    Added range check in H5T_insert
Platforms Tested:
    FreeBSD 4.4 (sleipnir)

1 files changed, 4 insertions, 0 deletions

diff --git a/src/H5T.c b/src/H5T.c
index c778f26..6feed09 100644
--- a/src/H5T.c
+++ b/src/H5T.c
@@ -6364,6 +6364,10 @@ H5T_insert(H5T_t *parent, const char *name, size_t offset, const H5T_t *member)
 	}
     }
 
+    /* Does the new member overlap the end of the compound type? */
+    if(offset+total_size>parent->size)
+        HRETURN_ERROR(H5E_DATATYPE, H5E_CANTINSERT, FAIL, "member extends past end of compound type");
+
     /* Increase member array if necessary */
     if (parent->u.compnd.nmembs >= parent->u.compnd.nalloc) {
         size_t na = parent->u.compnd.nalloc + H5T_COMPND_INC;