Fix for HDFFV-10216 segfault in H5G_node_cmp3 with corrupt h5 file

Fix H5HL_offset_into() to return error when offset exceeds heap data block size.
Also fix other places that call this routine to detect error return.

1 files changed, 55 insertions, 0 deletions

diff --git a/test/tmisc.c b/test/tmisc.c
index 708ca9b..242e55a 100644
--- a/test/tmisc.c
+++ b/test/tmisc.c
@@ -318,6 +318,11 @@ typedef struct
 #define MISC31_PROPNAME         "misc31_prop"
 #define MISC31_DTYPENAME        "dtype"
 
+/* Definitions for misc. test #33 */
+/* Note that this test file is generated by "gen_bad_offset.c" */
+/* and bad offset values are written to that file for testing */
+#define MISC33_FILE             "bad_offset.h5"
+
 /****************************************************************
 **
 **  test_misc1(): test unlinking a dataset from a group and immediately
@@ -5472,6 +5477,55 @@ test_misc32(void)
     
 } /* end test_misc32() */
 
+/****************************************************************
+**
+**  test_misc33(): Test for H5FFV-10216
+**      --verify that H5HL_offset_into() returns error if the
+**        input parameter "offset" exceeds heap data block size.
+**      --case (1), (2), (3) are scenarios that will traverse to the
+**        the 3 locations in the file having bad offset values to
+**        the heap.  (See description in gen_bad_offset.c)
+**
+****************************************************************/
+static void
+test_misc33(void)
+{
+    hid_t   fid = -1;   /* File ID */
+    const char *testfile = H5_get_srcdir_filename(MISC33_FILE); /* Corrected test file name */
+    H5O_info_t oinfo;   /* Structure for object metadata information */
+    herr_t  ret;        /* Generic return value */
+
+    /* Output message about test being performed */
+    MESSAGE(5, ("Testing that bad offset into the heap returns error"));
+
+    /* Open the test file */
+    fid = H5Fopen(testfile, H5F_ACC_RDWR, H5P_DEFAULT);
+    CHECK(fid, FAIL, "H5Fopen");
+
+    /* Case (1) */
+    H5E_BEGIN_TRY {
+        ret = H5Oget_info_by_name(fid, "/soft_two", &oinfo, H5P_DEFAULT);
+    } H5E_END_TRY;
+    VERIFY(ret, FAIL, "H5Oget_info_by_name");
+
+    /* Case (2) */
+    H5E_BEGIN_TRY {
+        ret = H5Oget_info_by_name(fid, "/dsetA", &oinfo, H5P_DEFAULT);
+    } H5E_END_TRY;
+    VERIFY(ret, FAIL, "H5Oget_info_by_name");
+
+    /* Case (3) */
+    H5E_BEGIN_TRY {
+        ret = H5Oget_info_by_name(fid, "/soft_one", &oinfo, H5P_DEFAULT);
+    } H5E_END_TRY;
+    VERIFY(ret, FAIL, "H5Oget_info_by_name");
+
+    /* Close the file */
+    ret = H5Fclose(fid);
+    CHECK(fid, FAIL, "H5Fclose");
+
+} /* end test_misc33() */
+
 
 /****************************************************************
 **
@@ -5520,6 +5574,7 @@ test_misc(void)
     test_misc30();      /* Exercise local heap loading bug where free lists were getting dropped */
     test_misc31();      /* Test Reentering library through deprecated routines after H5close() */
     test_misc32();      /* Test filter memory allocation functions */
+    test_misc33();      /* ??? */
 
 } /* test_misc() */