[svn-r18213] Description:

    Bring r18212 from trunk to 1.8 branch:

    Bring revisions from Coverity fixing branch to trunk:

r18184:
Fixed Coverity issue 373.  Allocated memory freed in line 762 in case of error.

r18185:
Fixed Coverity issues 357 & 358.  Added check for NULL pointer before use.

r18186:
Fix coverity item 65.   Added code to h5unjam to correctly handle failures in
read() and write, and also to correctly handle writes that write less than
requested.

r18187:
Fix coverity items 115 and 116.   Added code to H5Tenum.c to correctly close
opened datatypes in case of failure.

r18188:
Fixed Coverity issue 46.  Check that dataset->shared is not null when freeing
memory after error.

r18190:
Fix coverity item 95.   Added code to H5T_create_vlen to correctly close
allocated datatype in case of failure.

r18191:
Fixed Coverity error 59.  Checked sfirst for -1 value before use in line 10533.

r18192:
Fix Coverity items 121 and 28

Added Asserts:
121: assert that all dimensions of count have values greater than zero.
28: assert curr_span pointer is not null before dereference.

Note: still need too add checks in hyperslab APIs that fail
    when count values are zero, and appropriate tests.

r18194:
Fixed Coverity issues 61 & 62. Checked variable snpoints for value < 0 in line
218.

Tested on:
    Mac OS X/32 10.6.2 (amazon) w/debug & production
    (already daily tested on coverity branch)

6 files changed, 45 insertions, 28 deletions

diff --git a/src/H5Dcontig.c b/src/H5Dcontig.c
index e2fe420..7c1b87c 100644
--- a/src/H5Dcontig.c
+++ b/src/H5Dcontig.c
@@ -217,8 +217,8 @@ H5D_contig_fill(H5D_t *dset, hid_t dxpl_id)
     store.contig.dset_size = dset->shared->layout.storage.u.contig.size;
 
     /* Get the number of elements in the dataset's dataspace */
-    snpoints = H5S_GET_EXTENT_NPOINTS(dset->shared->space);
-    HDassert(snpoints >= 0);
+    if((snpoints = H5S_GET_EXTENT_NPOINTS(dset->shared->space)) < 0)
+        HGOTO_ERROR(H5E_DATASET, H5E_CANTGET, FAIL, "dataset has negative number of elements")
     H5_ASSIGN_OVERFLOW(npoints, snpoints, hssize_t, size_t);
 
     /* Initialize the fill value buffer */
diff --git a/src/H5Dint.c b/src/H5Dint.c
index 3d5a5e7..bfe16f7 100644
--- a/src/H5Dint.c
+++ b/src/H5Dint.c
@@ -1309,17 +1309,19 @@ done:
     if(ret_value < 0) {
         if(H5F_addr_defined(dataset->oloc.addr) && H5O_close(&(dataset->oloc)) < 0)
             HDONE_ERROR(H5E_DATASET, H5E_CLOSEERROR, FAIL, "unable to release object header")
-        if(dataset->shared->space && H5S_close(dataset->shared->space) < 0)
-            HDONE_ERROR(H5E_DATASET, H5E_CLOSEERROR, FAIL, "unable to release dataspace")
-        if(dataset->shared->type) {
-            if(dataset->shared->type_id > 0) {
-                if(H5I_dec_ref(dataset->shared->type_id, FALSE) < 0)
-                    HDONE_ERROR(H5E_DATASET, H5E_CLOSEERROR, FAIL, "unable to release datatype")
+        if(dataset->shared) {
+            if(dataset->shared->space && H5S_close(dataset->shared->space) < 0)
+                HDONE_ERROR(H5E_DATASET, H5E_CLOSEERROR, FAIL, "unable to release dataspace")
+            if(dataset->shared->type) {
+                if(dataset->shared->type_id > 0) {
+                    if(H5I_dec_ref(dataset->shared->type_id, FALSE) < 0)
+                        HDONE_ERROR(H5E_DATASET, H5E_CLOSEERROR, FAIL, "unable to release datatype")
+                } /* end if */
+                else {
+                    if(H5T_close(dataset->shared->type) < 0)
+                        HDONE_ERROR(H5E_DATASET, H5E_CLOSEERROR, FAIL, "unable to release datatype")
+                } /* end else */
             } /* end if */
-            else {
-                if(H5T_close(dataset->shared->type) < 0)
-                    HDONE_ERROR(H5E_DATASET, H5E_CLOSEERROR, FAIL, "unable to release datatype")
-            } /* end else */
         } /* end if */
     } /* end if */
 
diff --git a/src/H5Shyper.c b/src/H5Shyper.c
index 857df97..ea37e40 100644
--- a/src/H5Shyper.c
+++ b/src/H5Shyper.c
@@ -5450,6 +5450,8 @@ H5S_hyper_make_spans (unsigned rank, const hsize_t *start, const hsize_t *stride
         head = NULL;
         last_span = NULL;
 
+        HDassert(count[i] > 0);
+
         /* Generate all the span segments for this dimension */
         for(u = 0, stride_iter = 0; u < count[i]; u++, stride_iter += stride[i]) {
             /* Allocate a span node */
@@ -7492,23 +7494,26 @@ H5S_hyper_get_seq_list_gen(const H5S_t *space,H5S_sel_iter_t *iter,
 partial_done:   /* Yes, goto's are evil, so sue me... :-) */
 
     /* Perform the I/O on the elements, based on the position of the iterator */
-    while(io_bytes_left>0 && curr_seq<maxseq) {
+    while(io_bytes_left > 0 && curr_seq < maxseq) {
+        /* Sanity check */
+        HDassert(curr_span);
+
         /* Adjust location offset of destination to compensate for initial increment below */
-        loc_off-=curr_span->pstride;
+        loc_off -= curr_span->pstride;
 
         /* Loop over all the spans in the fastest changing dimension */
-        while(curr_span!=NULL) {
+        while(curr_span != NULL) {
             /* Move location offset of destination */
-            loc_off+=curr_span->pstride;
+            loc_off += curr_span->pstride;
 
             /* Compute the number of elements to attempt in this span */
-            H5_ASSIGN_OVERFLOW(span_size,curr_span->nelem,hsize_t,size_t);
+            H5_ASSIGN_OVERFLOW(span_size, curr_span->nelem, hsize_t, size_t);
 
             /* Check number of elements against upper bounds allowed */
-            if(span_size>=io_bytes_left) {
+            if(span_size >= io_bytes_left) {
                 /* Trim the number of bytes to output */
-                span_size=io_bytes_left;
-                io_bytes_left=0;
+                span_size = io_bytes_left;
+                io_bytes_left = 0;
 
 /* COMMON */
                 /* Store the I/O information for the span */
diff --git a/src/H5Tconv.c b/src/H5Tconv.c
index bfa5d56..cda9011 100644
--- a/src/H5Tconv.c
+++ b/src/H5Tconv.c
@@ -10501,6 +10501,8 @@ H5T_conv_i_f (hid_t src_id, hid_t dst_id, H5T_cdata_t *cdata, size_t nelmts,
                         sfirst = (ssize_t)(src.prec - 1);
                         is_max_neg = 0;
                     }
+                    if(sfirst < 0)
+                        HGOTO_ERROR(H5E_DATATYPE, H5E_CANTCONVERT, FAIL, "zero bit not found")
 
                     /* Sign bit has been negated if bit vector isn't 0x80...00.  Set all bits in front of
                      * sign bit to 0 in the temporary buffer because they're all negated from the previous
diff --git a/src/H5Tenum.c b/src/H5Tenum.c
index f955a7e..6da6931 100644
--- a/src/H5Tenum.c
+++ b/src/H5Tenum.c
@@ -466,10 +466,11 @@ H5T_enum_nameof(const H5T_t *dt, const void *value, char *name/*out*/, size_t si
     /* Set return value */
     ret_value=name;
 
-    if (H5T_close(copied_dt)<0)
-	HGOTO_ERROR(H5E_DATATYPE, H5E_CANTCLOSEOBJ, NULL, "unable to close data type");
-
 done:
+    if(copied_dt)
+        if(H5T_close(copied_dt) < 0)
+            HDONE_ERROR(H5E_DATATYPE, H5E_CANTCLOSEOBJ, NULL, "unable to close data type");
+
     FUNC_LEAVE_NOAPI(ret_value)
 }
 
@@ -591,9 +592,11 @@ H5T_enum_valueof(const H5T_t *dt, const char *name, void *value/*out*/)
 
     HDmemcpy(value, copied_dt->shared->u.enumer.value+md*copied_dt->shared->size, copied_dt->shared->size);
 
-    if (H5T_close(copied_dt)<0)
-	HGOTO_ERROR(H5E_DATATYPE, H5E_CANTCLOSEOBJ, FAIL, "unable to close data type");
-
 done:
+    if(copied_dt)
+        if(H5T_close(copied_dt) < 0)
+            HDONE_ERROR(H5E_DATATYPE, H5E_CANTCLOSEOBJ, FAIL, "unable to close data type")
+
     FUNC_LEAVE_NOAPI(ret_value)
 }
+
diff --git a/src/H5Tvlen.c b/src/H5Tvlen.c
index f09c42c..8a6ee05 100644
--- a/src/H5Tvlen.c
+++ b/src/H5Tvlen.c
@@ -161,7 +161,7 @@ H5T_vlen_create(const H5T_t *base)
 
     /* Build new type */
     if(NULL == (dt = H5T_alloc()))
-        HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
+        HGOTO_ERROR(H5E_DATATYPE, H5E_CANTALLOC, NULL, "memory allocation failed")
     dt->shared->type = H5T_VLEN;
 
     /*
@@ -169,7 +169,8 @@ H5T_vlen_create(const H5T_t *base)
      * data, not point to the same VL sequences)
      */
     dt->shared->force_conv = TRUE;
-    dt->shared->parent = H5T_copy(base, H5T_COPY_ALL);
+    if(NULL == (dt->shared->parent = H5T_copy(base, H5T_COPY_ALL)))
+        HGOTO_ERROR(H5E_DATATYPE, H5E_CANTCOPY, NULL, "can't copy base datatype")
 
     /* Inherit encoding version from base type */
     dt->shared->version = base->shared->version;
@@ -185,6 +186,10 @@ H5T_vlen_create(const H5T_t *base)
     ret_value = dt;
 
 done:
+    if(!ret_value)
+        if(dt && H5T_close(dt) < 0)
+            HDONE_ERROR(H5E_DATATYPE, H5E_CANTRELEASE, NULL, "unable to release datatype info")
+
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5T_vlen_create() */