[svn-r18300] Description:

    Bring Coverity fixes from branch to trunk:

r18282:
   Fix Coverity issue #428 by wrapping testing calls with if(pass) {} block.

r18283:
   Fix Coverity issue #425 by wrapping test calls in if(pass) {} block

r18284:
Issue 166:  init_error() malloc'd 3 pointers in initialization and never freed 
inc ase of errors. Init pointers to NULL, check allocation results and free
allocations in error block

r18285:
   Fix Coverity issue #410 by wrapping test calls with if(pass) {} block.

r18286:
Issue 165:  custom_print_cb() needed allocations freed in error block.

r18287:
Fix coverity issue # 409

Added if (pass) checks around calls to flush_cache. Additionally, 
added a check for file_ptr = NULL after call to setup_cache.

r18288:
Fix coverity# 107 free fh in H5HF_close() correctly before exit the function
even when failure occurs.

r18289:
   Fix Coverity issue #429: correct failure return values to match return type
from routine.

r18290:
   Fix Coverity issue #103: release allocated indirect section  on error

r18294:
Issue 153, 152:  Check allocations and free allocations in error block. Also
cleaned up hid_t identifer that were opened in error block.

r18295:
Fix coverity# 101 free new_loc in H5HF_man_iter_start_entry() correctly before
exit the function even when failure occurs

r18296:
Fix coverity# 100 free down_loc in H5HF_man_iter_down() before exit the function
when failure occurs

r18297:
Fixed coverity issues 54, 55 and 216.  Correctly handle the various ways that
allocation of attr_name can fail in test_attr_basic_write.

r18298:
Fix coverity# 119 free object in H5HG_read() before exit the function when
failure occurs

r18299:
Fix coverity issue #112:

Add cleanup during error handling of H5MP_create.


Tested on:
    Mac OS X/32 10.6.2 (amazon) w/debug & production
    Misc. Linux configurations (on original checkins)

6 files changed, 54 insertions, 35 deletions

diff --git a/src/H5Dchunk.c b/src/H5Dchunk.c
index ba4f795..e77f580 100644
--- a/src/H5Dchunk.c
+++ b/src/H5Dchunk.c
@@ -3421,7 +3421,7 @@ H5D_chunk_prune_fill(const H5D_chunk_rec_t *chunk_rec, H5D_chunk_it_ud1_t *udata
 
     /* Calculate the index of this chunk */
     if(H5V_chunk_index(rank, chunk_rec->offset, layout->u.chunk.dim, layout->u.chunk.down_chunks, &io_info->store->chunk.index) < 0)
-        HGOTO_ERROR(H5E_DATASET, H5E_CANTINIT, H5_ITER_ERROR, "can't get chunk index")
+        HGOTO_ERROR(H5E_DATASET, H5E_CANTINIT, FAIL, "can't get chunk index")
 
     /* Lock the chunk into the cache, to get a pointer to the chunk buffer */
     /* (Casting away const OK -QAK) */
@@ -3780,7 +3780,7 @@ H5D_chunk_prune_by_extent(H5D_t *dset, hid_t dxpl_id, const hsize_t *old_dims)
         if(needs_fill) {
             /* Allocate space for the stack node */
             if(NULL == (tmp_stack = H5FL_MALLOC(H5D_chunk_prune_stack_t)))
-                HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, H5_ITER_ERROR, "memory allocation failed for stack node")
+                HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed for stack node")
 
             /* Set up chunk record for fill routine */
             tmp_stack->rec.nbytes = dset->shared->layout.u.chunk.size;
@@ -3800,7 +3800,7 @@ H5D_chunk_prune_by_extent(H5D_t *dset, hid_t dxpl_id, const hsize_t *old_dims)
     while(tmp_stack) {
         /* Write the fill value */
         if(H5D_chunk_prune_fill(&(tmp_stack->rec), &udata) < 0)
-            HGOTO_ERROR(H5E_DATASET, H5E_WRITEERROR, H5_ITER_ERROR, "unable to write fill value")
+            HGOTO_ERROR(H5E_DATASET, H5E_WRITEERROR, FAIL, "unable to write fill value")
 
         /* Advance the stack pointer */
         tmp_stack = tmp_stack->next;
@@ -3821,7 +3821,7 @@ H5D_chunk_prune_by_extent(H5D_t *dset, hid_t dxpl_id, const hsize_t *old_dims)
 
         /* Remove the chunk from disk */
         if((layout->storage.u.chunk.ops->remove)(&idx_info, &idx_udata) < 0)
-            HGOTO_ERROR(H5E_DATASET, H5E_CANTDELETE, H5_ITER_ERROR, "unable to remove chunk entry from index")
+            HGOTO_ERROR(H5E_DATASET, H5E_CANTDELETE, FAIL, "unable to remove chunk entry from index")
 
         /* Advance the stack pointer */
         tmp_stack = tmp_stack->next;
@@ -4157,7 +4157,7 @@ H5D_chunk_copy_cb(const H5D_chunk_rec_t *chunk_rec, void *_udata)
         else if((H5T_get_class(udata->dt_src, FALSE) == H5T_REFERENCE) && (udata->file_src != udata->idx_info_dst->f))
             fix_ref = TRUE;
         else
-            HGOTO_ERROR(H5E_DATASET, H5E_CANTCOPY, FAIL, "unable to copy dataset elements")
+            HGOTO_ERROR(H5E_DATASET, H5E_CANTCOPY, H5_ITER_ERROR, "unable to copy dataset elements")
     } /* end if */
 
     /* Check for filtered chunks */
@@ -4241,7 +4241,7 @@ H5D_chunk_copy_cb(const H5D_chunk_rec_t *chunk_rec, void *_udata)
 
             /* Copy the reference elements */
             if(H5O_copy_expand_ref(udata->file_src, buf, udata->idx_info_dst->dxpl_id, udata->idx_info_dst->f, bkg, ref_count, H5T_get_ref_type(udata->dt_src), udata->cpy_info) < 0)
-                HGOTO_ERROR(H5E_DATASET, H5E_CANTCOPY, FAIL, "unable to copy reference attribute")
+                HGOTO_ERROR(H5E_DATASET, H5E_CANTCOPY, H5_ITER_ERROR, "unable to copy reference attribute")
         } /* end if */
 
         /* After fix ref, copy the new reference elements to the buffer to write out */
@@ -4263,7 +4263,7 @@ H5D_chunk_copy_cb(const H5D_chunk_rec_t *chunk_rec, void *_udata)
 #if H5_SIZEOF_SIZE_T > 4
         /* Check for the chunk expanding too much to encode in a 32-bit value */
         if(nbytes > ((size_t)0xffffffff))
-            HGOTO_ERROR(H5E_DATASET, H5E_BADRANGE, FAIL, "chunk too large for 32-bit length")
+            HGOTO_ERROR(H5E_DATASET, H5E_BADRANGE, H5_ITER_ERROR, "chunk too large for 32-bit length")
 #endif /* H5_SIZEOF_SIZE_T > 4 */
         H5_ASSIGN_OVERFLOW(udata_dst.nbytes, nbytes, size_t, uint32_t);
 	udata->buf = buf;
@@ -4272,7 +4272,7 @@ H5D_chunk_copy_cb(const H5D_chunk_rec_t *chunk_rec, void *_udata)
 
     /* Insert chunk into the destination index */
     if((udata->idx_info_dst->storage->ops->insert)(udata->idx_info_dst, &udata_dst) < 0)
-        HGOTO_ERROR(H5E_DATASET, H5E_CANTINSERT, FAIL, "unable to insert chunk into index")
+        HGOTO_ERROR(H5E_DATASET, H5E_CANTINSERT, H5_ITER_ERROR, "unable to insert chunk into index")
 
     /* Write chunk data to destination file */
     HDassert(H5F_addr_defined(udata_dst.addr));
diff --git a/src/H5HF.c b/src/H5HF.c
index 0856d89..18e1cdb 100644
--- a/src/H5HF.c
+++ b/src/H5HF.c
@@ -867,10 +867,10 @@ HDfprintf(stderr, "%s; After iterator reset fh->hdr->rc = %Zu\n", FUNC, fh->hdr-
             HGOTO_ERROR(H5E_HEAP, H5E_CANTDELETE, FAIL, "unable to delete fractal heap")
     } /* end if */
 
+done:
     /* Release the fractal heap wrapper */
-    (void)H5FL_FREE(H5HF_t, fh);
+    fh = H5FL_FREE(H5HF_t, fh);
 
-done:
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5HF_close() */
 
diff --git a/src/H5HFiter.c b/src/H5HFiter.c
index a3c61d7..f7178a1 100644
--- a/src/H5HFiter.c
+++ b/src/H5HFiter.c
@@ -315,7 +315,7 @@ herr_t
 H5HF_man_iter_start_entry(H5HF_hdr_t *hdr, H5HF_block_iter_t *biter,
     H5HF_indirect_t *iblock, unsigned start_entry)
 {
-    H5HF_block_loc_t *new_loc;          /* Pointer to new block location */
+    H5HF_block_loc_t *new_loc = NULL;   /* Pointer to new block location */
     herr_t ret_value = SUCCEED;         /* Return value */
 
     FUNC_ENTER_NOAPI_NOINIT(H5HF_man_iter_start_entry)
@@ -350,6 +350,9 @@ H5HF_man_iter_start_entry(H5HF_hdr_t *hdr, H5HF_block_iter_t *biter,
     biter->ready = TRUE;
 
 done:
+    if(ret_value < 0 && new_loc)
+        new_loc = H5FL_FREE(H5HF_block_loc_t, new_loc);
+
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5HF_man_iter_start_entry() */
 
@@ -397,7 +400,7 @@ H5HF_man_iter_reset(H5HF_block_iter_t *biter)
                     HGOTO_ERROR(H5E_HEAP, H5E_CANTDEC, FAIL, "can't decrement reference count on shared indirect block")
 
             /* Free the current location context */
-            (void)H5FL_FREE(H5HF_block_loc_t, curr_loc);
+            curr_loc = H5FL_FREE(H5HF_block_loc_t, curr_loc);
 
             /* Advance to next location */
             curr_loc = next_loc;
@@ -489,7 +492,7 @@ H5HF_man_iter_up(H5HF_block_iter_t *biter)
     up_loc = biter->curr->up;
 
     /* Release this location */
-    (void)H5FL_FREE(H5HF_block_loc_t, biter->curr);
+    biter->curr = H5FL_FREE(H5HF_block_loc_t, biter->curr);
 
     /* Point location to next location up */
     biter->curr = up_loc;
@@ -515,7 +518,7 @@ done:
 herr_t
 H5HF_man_iter_down(H5HF_block_iter_t *biter, H5HF_indirect_t *iblock)
 {
-    H5HF_block_loc_t *down_loc;         /* Pointer to new 'down' block location */
+    H5HF_block_loc_t *down_loc = NULL;  /* Pointer to new 'down' block location */
     herr_t ret_value = SUCCEED;         /* Return value */
 
     FUNC_ENTER_NOAPI_NOINIT(H5HF_man_iter_down)
@@ -547,6 +550,9 @@ H5HF_man_iter_down(H5HF_block_iter_t *biter, H5HF_indirect_t *iblock)
     biter->curr = down_loc;
 
 done:
+    if(ret_value < 0 && down_loc)
+        down_loc = H5FL_FREE(H5HF_block_loc_t, down_loc);
+
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5HF_man_iter_down() */
 
diff --git a/src/H5HFsection.c b/src/H5HFsection.c
index 102dc7c..9b23e5d 100644
--- a/src/H5HFsection.c
+++ b/src/H5HFsection.c
@@ -1372,7 +1372,7 @@ H5HF_sect_row_from_single(H5HF_hdr_t *hdr, H5HF_free_section_t *sect,
 
     /* Release single section's hold on underlying indirect block */
     if(H5HF_iblock_decr(dblock->parent) < 0)
-        HDONE_ERROR(H5E_HEAP, H5E_CANTDEC, FAIL, "can't decrement reference count on shared indirect block")
+        HGOTO_ERROR(H5E_HEAP, H5E_CANTDEC, FAIL, "can't decrement reference count on shared indirect block")
 
 done:
     FUNC_LEAVE_NOAPI(ret_value)
@@ -3756,7 +3756,7 @@ static herr_t
 H5HF_sect_indirect_build_parent(H5HF_hdr_t *hdr, H5HF_free_section_t *sect)
 {
     H5HF_indirect_t *par_iblock;        /* Indirect block for parent section */
-    H5HF_free_section_t *par_sect;      /* Parent indirect section */
+    H5HF_free_section_t *par_sect = NULL; /* Parent indirect section */
     unsigned par_row, par_col;          /* Row & column in parent indirect section */
     unsigned par_entry;                 /* Entry within parent indirect section */
     herr_t ret_value = SUCCEED;         /* Return value */
@@ -3802,6 +3802,10 @@ H5HF_sect_indirect_build_parent(H5HF_hdr_t *hdr, H5HF_free_section_t *sect)
     par_sect->u.indirect.rc = 1;
 
 done:
+    if(ret_value < 0)
+        if(par_sect && H5HF_sect_indirect_free(par_sect) < 0)
+            HDONE_ERROR(H5E_HEAP, H5E_CANTRELEASE, FAIL, "can't free indirect section node")
+
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5HF_sect_indirect_build_parent() */
 
diff --git a/src/H5HG.c b/src/H5HG.c
index 0e3f0e9..f1edb71 100644
--- a/src/H5HG.c
+++ b/src/H5HG.c
@@ -640,10 +640,11 @@ void *
 H5HG_read(H5F_t *f, hid_t dxpl_id, H5HG_t *hobj, void *object/*out*/,
     size_t *buf_size)
 {
-    H5HG_heap_t	*heap = NULL;
-    size_t	size;
-    uint8_t	*p = NULL;
-    void	*ret_value;
+    H5HG_heap_t	*heap = NULL;           /* Pointer to global heap object */
+    size_t	size;                   /* Size of the heap object */
+    uint8_t	*p;                     /* Pointer to object in heap buffer */
+    void        *orig_object = object;  /* Keep a copy of the original object pointer */
+    void	*ret_value;             /* Return value */
 
     FUNC_ENTER_NOAPI(H5HG_read, NULL)
 
@@ -659,6 +660,7 @@ H5HG_read(H5F_t *f, hid_t dxpl_id, H5HG_t *hobj, void *object/*out*/,
     HDassert(heap->obj[hobj->idx].begin);
     size = heap->obj[hobj->idx].size;
     p = heap->obj[hobj->idx].begin + H5HG_SIZEOF_OBJHDR(f);
+
     /* Allocate a buffer for the object read in, if the user didn't give one */
     if(!object && NULL == (object = H5MM_malloc(size)))
 	HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
@@ -692,6 +694,9 @@ done:
     if(heap && H5AC_unprotect(f, dxpl_id, H5AC_GHEAP, hobj->addr, heap, H5AC__NO_FLAGS_SET)<0)
         HDONE_ERROR(H5E_HEAP, H5E_PROTECT, NULL, "unable to release object header")
 
+    if(NULL == ret_value && NULL == orig_object && object)
+        H5MM_free(object);
+
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5HG_read() */
 
diff --git a/src/H5MP.c b/src/H5MP.c
index 63a65ae..dd54316 100644
--- a/src/H5MP.c
+++ b/src/H5MP.c
@@ -87,16 +87,16 @@ H5FL_DEFINE(H5MP_pool_t);
  *-------------------------------------------------------------------------
  */
 H5MP_pool_t *
-H5MP_create (size_t page_size, unsigned flags)
+H5MP_create(size_t page_size, unsigned flags)
 {
-    H5MP_pool_t *mp;                    /* New memory pool header */
+    H5MP_pool_t *mp = NULL;             /* New memory pool header */
     H5MP_pool_t *ret_value;             /* Return value */
 
     FUNC_ENTER_NOAPI(H5MP_create, NULL)
 
     /* Allocate space for the pool header */
-    if (NULL==(mp = H5FL_MALLOC(H5MP_pool_t)))
-	HGOTO_ERROR (H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for memory pool header")
+    if(NULL == (mp = H5FL_MALLOC(H5MP_pool_t)))
+	HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for memory pool header")
 
     /* Assign information */
     mp->page_size = H5MP_BLOCK_ALIGN(page_size);
@@ -108,13 +108,17 @@ H5MP_create (size_t page_size, unsigned flags)
     mp->max_size = mp->page_size - H5MP_BLOCK_ALIGN(sizeof(H5MP_page_t));
 
     /* Create factory for pool pages */
-    if((mp->page_fac=H5FL_fac_init(page_size))==NULL)
-	HGOTO_ERROR (H5E_RESOURCE, H5E_CANTINIT, NULL, "can't create page factory")
+    if(NULL == (mp->page_fac = H5FL_fac_init(page_size)))
+	HGOTO_ERROR(H5E_RESOURCE, H5E_CANTINIT, NULL, "can't create page factory")
 
     /* Set return value */
     ret_value = mp;
 
 done:
+    if(NULL == ret_value && mp)
+        if(H5MP_close(mp) < 0)
+            HDONE_ERROR(H5E_RESOURCE, H5E_CANTFREE, NULL, "unable to free memory pool header")
+
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5MP_create() */
 
@@ -271,7 +275,7 @@ HDfprintf(stderr,"%s: request = %Zu, needed = %Zu\n", FUNC, request, needed);
 
         /* Allocate new page */
         if(NULL == (alloc_page = H5MP_new_page(mp, page_size)))
-            HGOTO_ERROR (H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for page")
+            HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for page")
 
         /* Set the block to allocate from */
         alloc_free = alloc_page->free_blk;
@@ -343,7 +347,7 @@ done:
  *-------------------------------------------------------------------------
  */
 void *
-H5MP_free (H5MP_pool_t *mp, void *spc)
+H5MP_free(H5MP_pool_t *mp, void *spc)
 {
     H5MP_page_blk_t *spc_blk;           /* Block for space to free */
     H5MP_page_t *spc_page;              /* Page containing block to free */
@@ -430,7 +434,7 @@ HDfprintf(stderr,"%s: Freeing from page = %p\n", "H5MP_free", spc_page);
  *-------------------------------------------------------------------------
  */
 herr_t
-H5MP_close (H5MP_pool_t *mp)
+H5MP_close(H5MP_pool_t *mp)
 {
     herr_t ret_value = SUCCEED;         /* Return value */
 
@@ -447,9 +451,9 @@ H5MP_close (H5MP_pool_t *mp)
 
             /* Free the page appropriately */
             if(page->fac_alloc)
-                H5FL_FAC_FREE(mp->page_fac,page);
+                page = H5FL_FAC_FREE(mp->page_fac, page);
             else
-                H5MM_xfree(page);
+                page = H5MM_xfree(page);
 
             page = next_page;
         } /* end while */
@@ -457,13 +461,13 @@ H5MP_close (H5MP_pool_t *mp)
 
     /* Release page factory */
     if(mp->page_fac)
-        if(H5FL_fac_term(mp->page_fac)<0)
-            HGOTO_ERROR (H5E_RESOURCE, H5E_CANTRELEASE, FAIL, "can't destroy page factory")
+        if(H5FL_fac_term(mp->page_fac) < 0)
+            HGOTO_ERROR(H5E_RESOURCE, H5E_CANTRELEASE, FAIL, "can't destroy page factory")
 
+done:
     /* Free the memory pool itself */
-    (void)H5FL_FREE(H5MP_pool_t, mp);
+    mp = H5FL_FREE(H5MP_pool_t, mp);
 
-done:
     FUNC_LEAVE_NOAPI(ret_value)
 } /* end H5MP_close() */