summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--src/H5Obogus.c22
-rw-r--r--src/H5Ocache_image.c37
-rw-r--r--src/H5Odrvinfo.c42
-rw-r--r--src/H5Ofill.c104
-rw-r--r--src/H5Ofsinfo.c70
-rw-r--r--src/H5Oginfo.c41
-rw-r--r--src/H5Olayout.c133
-rw-r--r--src/H5Olinfo.c15
-rw-r--r--src/H5Olink.c102
-rw-r--r--src/H5Opline.c96
-rw-r--r--src/H5Orefcount.c35
-rw-r--r--src/H5Osdspace.c54
-rw-r--r--src/H5Oshmesg.c31
-rw-r--r--src/H5Ostab.c34
14 files changed, 407 insertions, 409 deletions
diff --git a/src/H5Obogus.c b/src/H5Obogus.c
index 549c3e9..1b83ed1 100644
--- a/src/H5Obogus.c
+++ b/src/H5Obogus.c
@@ -13,8 +13,6 @@
/*-------------------------------------------------------------------------
*
* Created: H5Obogus.c
- * Jan 21 2003
- * Quincey Koziol
*
* Purpose: "bogus" message. This message is guaranteed to never
* be found in a valid HDF5 file and is only used to
@@ -95,25 +93,20 @@ const H5O_msg_class_t H5O_MSG_BOGUS_INVALID[1] = {{
* Purpose: Decode a "bogus" message and return a pointer to a new
* native message struct.
*
- * Return: Success: Ptr to new message in native struct.
- *
+ * Return: Success: Pointer to new message in native struct
* Failure: NULL
- *
- * Programmer: Quincey Koziol
- * Jan 21 2003
- *
*-------------------------------------------------------------------------
*/
static void *
-H5O__bogus_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
- unsigned H5_ATTR_UNUSED *ioflags, size_t H5_ATTR_UNUSED p_size, const uint8_t *p)
+H5O__bogus_decode(H5F_t *f, H5O_t H5_ATTR_NDEBUG_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
+ unsigned H5_ATTR_UNUSED *ioflags, size_t p_size, const uint8_t *p)
{
- H5O_bogus_t *mesg = NULL;
- void *ret_value; /* Return value */
+ const uint8_t *p_end = p + p_size - 1;
+ H5O_bogus_t *mesg = NULL;
+ void *ret_value;
FUNC_ENTER_PACKAGE
- /* check args */
HDassert(f);
HDassert(p);
@@ -121,7 +114,8 @@ H5O__bogus_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUS
if (NULL == (mesg = (H5O_bogus_t *)H5MM_calloc(sizeof(H5O_bogus_t))))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
- /* decode */
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
UINT32DECODE(p, mesg->u);
/* Validate the bogus info */
diff --git a/src/H5Ocache_image.c b/src/H5Ocache_image.c
index bd273ec..a06bebc 100644
--- a/src/H5Ocache_image.c
+++ b/src/H5Ocache_image.c
@@ -13,14 +13,12 @@
/*-------------------------------------------------------------------------
*
* Created: H5Ocache_image.c
- * June 21, 2015
- * John Mainzer
*
* Purpose: A message indicating that a metadata cache image block
- * of the indicated length exists at the specified offset
- * in the HDF5 file.
+ * of the indicated length exists at the specified offset
+ * in the HDF5 file.
*
- * The mdci_msg only appears in the superblock extension.
+ * The mdci_msg only appears in the superblock extension
*
*-------------------------------------------------------------------------
*/
@@ -79,30 +77,28 @@ H5FL_DEFINE(H5O_mdci_t);
* Function: H5O__mdci_decode
*
* Purpose: Decode a metadata cache image message and return a
- * pointer to a newly allocated H5O_mdci_t struct.
- *
- * Return: Success: Ptr to new message in native struct.
- * Failure: NULL
- *
- * Programmer: John Mainzer
- * 6/22/15
+ * pointer to a newly allocated H5O_mdci_t struct.
*
+ * Return: Success: Pointer to new message in native struct
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
H5O__mdci_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
- unsigned H5_ATTR_UNUSED *ioflags, size_t H5_ATTR_UNUSED p_size, const uint8_t *p)
+ unsigned H5_ATTR_UNUSED *ioflags, size_t p_size, const uint8_t *p)
{
- H5O_mdci_t *mesg; /* Native message */
- void *ret_value = NULL; /* Return value */
+ H5O_mdci_t *mesg = NULL; /* New cache image message */
+ const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* Sanity check */
HDassert(f);
HDassert(p);
/* Version of message */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
if (*p++ != H5O_MDCI_VERSION_0)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "bad version number for message")
@@ -111,14 +107,21 @@ H5O__mdci_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL,
"memory allocation failed for metadata cache image message")
- /* Decode */
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_addr_decode(f, &p, &(mesg->addr));
+
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_DECODE_LENGTH(f, p, mesg->size);
/* Set return value */
ret_value = (void *)mesg;
done:
+ if (!ret_value && mesg)
+ H5FL_FREE(H5O_mdci_t, mesg);
+
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__mdci_decode() */
diff --git a/src/H5Odrvinfo.c b/src/H5Odrvinfo.c
index 923856f..53de66d 100644
--- a/src/H5Odrvinfo.c
+++ b/src/H5Odrvinfo.c
@@ -60,34 +60,32 @@ const H5O_msg_class_t H5O_MSG_DRVINFO[1] = {{
#define H5O_DRVINFO_VERSION 0
/*-------------------------------------------------------------------------
- * Function: H5O__drvinfo_decode
+ * Function: H5O__drvinfo_decode
*
- * Purpose: Decode a shared message table message and return a pointer
+ * Purpose: Decode a shared message table message and return a pointer
* to a newly allocated H5O_drvinfo_t struct.
*
- * Return: Success: Ptr to new message in native struct.
- * Failure: NULL
- *
- * Programmer: Quincey Koziol
- * Mar 1, 2007
- *
+ * Return: Success: Pointer to new message in native struct
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
H5O__drvinfo_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
- unsigned H5_ATTR_UNUSED mesg_flags, unsigned H5_ATTR_UNUSED *ioflags,
- size_t H5_ATTR_UNUSED p_size, const uint8_t *p)
+ unsigned H5_ATTR_UNUSED mesg_flags, unsigned H5_ATTR_UNUSED *ioflags, size_t p_size,
+ const uint8_t *p)
{
- H5O_drvinfo_t *mesg; /* Native message */
- void *ret_value = NULL; /* Return value */
+ H5O_drvinfo_t *mesg = NULL; /* Native message */
+ const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* Sanity check */
HDassert(f);
HDassert(p);
/* Version of message */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
if (*p++ != H5O_DRVINFO_VERSION)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "bad version number for message")
@@ -96,27 +94,37 @@ H5O__drvinfo_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for driver info message")
/* Retrieve driver name */
+ if (H5_IS_BUFFER_OVERFLOW(p, 8, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5MM_memcpy(mesg->name, p, 8);
mesg->name[8] = '\0';
p += 8;
/* Decode buffer size */
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
UINT16DECODE(p, mesg->len);
- HDassert(mesg->len);
+ if (0 == mesg->len)
+ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "message length can't be zero");
/* Allocate space for buffer */
- if (NULL == (mesg->buf = (uint8_t *)H5MM_malloc(mesg->len))) {
- mesg = (H5O_drvinfo_t *)H5MM_xfree(mesg);
+ if (NULL == (mesg->buf = (uint8_t *)H5MM_malloc(mesg->len)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for driver info buffer")
- } /* end if */
/* Copy encoded driver info into buffer */
+ if (H5_IS_BUFFER_OVERFLOW(p, mesg->len, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5MM_memcpy(mesg->buf, p, mesg->len);
/* Set return value */
ret_value = (void *)mesg;
done:
+ if (!ret_value && mesg) {
+ H5MM_xfree(mesg->buf);
+ H5MM_xfree(mesg);
+ }
+
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__drvinfo_decode() */
diff --git a/src/H5Ofill.c b/src/H5Ofill.c
index 45877d2..7b789bc 100644
--- a/src/H5Ofill.c
+++ b/src/H5Ofill.c
@@ -10,11 +10,9 @@
* help@hdfgroup.org. *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
-/* Programmer: Robb Matzke
- * Wednesday, September 30, 1998
- *
+/*
* Purpose: The fill message indicates a bit pattern to use for
- * uninitialized data points of a dataset.
+ * uninitialized data points of a dataset.
*/
#include "H5Omodule.h" /* This source code file is part of the H5O module */
@@ -179,16 +177,12 @@ H5FL_BLK_EXTERN(type_conv);
/*-------------------------------------------------------------------------
* Function: H5O__fill_new_decode
*
- * Purpose: Decode a new fill value message. The new fill value
- * message is fill value plus space allocation time and
- * fill value writing time and whether fill value is defined.
- *
- * Return: Success: Ptr to new message in native struct.
- * Failure: NULL
- *
- * Programmer: Raymond Lu
- * Feb 26, 2002
+ * Purpose: Decode a new fill value message. The new fill value
+ * message is fill value plus space allocation time and
+ * fill value writing time and whether fill value is defined.
*
+ * Return: Success: Pointer to new message in native struct
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
@@ -209,12 +203,21 @@ H5O__fill_new_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for fill value message")
/* Version */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
fill->version = *p++;
if (fill->version < H5O_FILL_VERSION_1 || fill->version > H5O_FILL_VERSION_LATEST)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "bad version number for fill value message")
/* Decode each version */
if (fill->version < H5O_FILL_VERSION_3) {
+
+ /* Versions 1 & 2 */
+
+ /* Buffer size check for the next three bytes */
+ if (H5_IS_BUFFER_OVERFLOW(p, 3, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
+
/* Space allocation time */
fill->alloc_time = (H5D_alloc_time_t)*p++;
@@ -226,26 +229,34 @@ H5O__fill_new_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
/* Only decode fill value information if one is defined */
if (fill->fill_defined) {
+
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
INT32DECODE(p, fill->size);
+
if (fill->size > 0) {
H5_CHECK_OVERFLOW(fill->size, ssize_t, size_t);
- /* Ensure that fill size doesn't exceed buffer size, due to possible data corruption */
- if (p + fill->size - 1 > p_end)
- HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "fill size exceeds buffer size")
+ if (H5_IS_BUFFER_OVERFLOW(p, fill->size, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
if (NULL == (fill->buf = H5MM_malloc((size_t)fill->size)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for fill value")
H5MM_memcpy(fill->buf, p, (size_t)fill->size);
- } /* end if */
- } /* end if */
+ }
+ }
else
- fill->size = (-1);
- } /* end if */
+ fill->size = -1;
+ }
else {
+
+ /* Version 3 */
+
unsigned flags; /* Status flags */
/* Flags */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
flags = *p++;
/* Check for unknown flags */
@@ -261,39 +272,45 @@ H5O__fill_new_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
/* Check for undefined fill value */
if (flags & H5O_FILL_FLAG_UNDEFINED_VALUE) {
- /* Sanity check */
- HDassert(!(flags & H5O_FILL_FLAG_HAVE_VALUE));
+
+ if (flags & (unsigned)~H5O_FILL_FLAG_HAVE_VALUE)
+ HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "have value and undefined value flags both set")
/* Set value for "undefined" fill value */
- fill->size = (-1);
- } /* end if */
+ fill->size = -1;
+ }
else if (flags & H5O_FILL_FLAG_HAVE_VALUE) {
/* Fill value size */
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
UINT32DECODE(p, fill->size);
/* Fill value */
H5_CHECK_OVERFLOW(fill->size, ssize_t, size_t);
+
+ if (H5_IS_BUFFER_OVERFLOW(p, fill->size, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
+
if (NULL == (fill->buf = H5MM_malloc((size_t)fill->size)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for fill value")
H5MM_memcpy(fill->buf, p, (size_t)fill->size);
/* Set the "defined" flag */
fill->fill_defined = TRUE;
- } /* end else */
+ }
else
/* Set the "defined" flag */
fill->fill_defined = TRUE;
- } /* end else */
+ }
/* Set return value */
ret_value = (void *)fill;
done:
if (!ret_value && fill) {
- if (fill->buf)
- H5MM_xfree(fill->buf);
+ H5MM_xfree(fill->buf);
fill = H5FL_FREE(H5O_fill_t, fill);
- } /* end if */
+ }
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__fill_new_decode() */
@@ -301,14 +318,10 @@ done:
/*-------------------------------------------------------------------------
* Function: H5O__fill_old_decode
*
- * Purpose: Decode an old fill value message.
- *
- * Return: Success: Ptr to new message in native struct.
- * Failure: NULL
- *
- * Programmer: Robb Matzke
- * Wednesday, September 30, 1998
+ * Purpose: Decode an old fill value message
*
+ * Return: Success: Pointer to new message in native struct
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
@@ -335,6 +348,8 @@ H5O__fill_old_decode(H5F_t *f, H5O_t *open_oh, unsigned H5_ATTR_UNUSED mesg_flag
fill->fill_time = H5D_FILL_TIME_IFSET;
/* Fill value size */
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
UINT32DECODE(p, fill->size);
/* Only decode the fill value itself if there is one */
@@ -342,8 +357,8 @@ H5O__fill_old_decode(H5F_t *f, H5O_t *open_oh, unsigned H5_ATTR_UNUSED mesg_flag
H5_CHECK_OVERFLOW(fill->size, ssize_t, size_t);
/* Ensure that fill size doesn't exceed buffer size, due to possible data corruption */
- if (p + fill->size - 1 > p_end)
- HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "fill size exceeds buffer size")
+ if (H5_IS_BUFFER_OVERFLOW(p, fill->size, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
/* Get the datatype message */
if ((exists = H5O_msg_exists_oh(open_oh, H5O_DTYPE_ID)) < 0)
@@ -354,15 +369,15 @@ H5O__fill_old_decode(H5F_t *f, H5O_t *open_oh, unsigned H5_ATTR_UNUSED mesg_flag
/* Verify size */
if (fill->size != (ssize_t)H5T_GET_SIZE(dt))
HGOTO_ERROR(H5E_SYM, H5E_CANTGET, NULL, "inconsistent fill value size")
- } /* end if */
+ }
if (NULL == (fill->buf = H5MM_malloc((size_t)fill->size)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for fill value")
H5MM_memcpy(fill->buf, p, (size_t)fill->size);
fill->fill_defined = TRUE;
- } /* end if */
+ }
else
- fill->size = (-1);
+ fill->size = -1;
/* Set return value */
ret_value = (void *)fill;
@@ -372,10 +387,9 @@ done:
H5O_msg_free(H5O_DTYPE_ID, dt);
if (!ret_value && fill) {
- if (fill->buf)
- H5MM_xfree(fill->buf);
- fill = H5FL_FREE(H5O_fill_t, fill);
- } /* end if */
+ H5MM_xfree(fill->buf);
+ H5FL_FREE(H5O_fill_t, fill);
+ }
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__fill_old_decode() */
diff --git a/src/H5Ofsinfo.c b/src/H5Ofsinfo.c
index b376606..eb4ed5e 100644
--- a/src/H5Ofsinfo.c
+++ b/src/H5Ofsinfo.c
@@ -13,10 +13,8 @@
/*-------------------------------------------------------------------------
*
* Created: H5Ofsinfo.c
- * Feb 2009
- * Vailin Choi
*
- * Purpose: File space info message.
+ * Purpose: File space info message
*
*-------------------------------------------------------------------------
*/
@@ -82,27 +80,22 @@ H5FL_DEFINE_STATIC(H5O_fsinfo_t);
*
* Purpose: Decode a message and return a pointer to a newly allocated one.
*
- * Return: Success: Ptr to new message in native form.
- * Failure: NULL
- *
- * Programmer: Vailin Choi; Feb 2009
- *
+ * Return: Success: Pointer to new message in native form
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
-
static void *
H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
unsigned H5_ATTR_UNUSED *ioflags, size_t p_size, const uint8_t *p)
{
- H5O_fsinfo_t *fsinfo = NULL; /* File space info message */
- H5F_mem_page_t ptype; /* Memory type for iteration */
- unsigned vers; /* message version */
- const uint8_t *p_end = p + p_size;
- void *ret_value = NULL; /* Return value */
+ H5O_fsinfo_t *fsinfo = NULL; /* File space info message */
+ H5F_mem_page_t ptype; /* Memory type for iteration */
+ unsigned vers; /* Message version */
+ const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* check args */
HDassert(f);
HDassert(p);
@@ -114,8 +107,8 @@ H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
fsinfo->fs_addr[ptype - 1] = HADDR_UNDEF;
/* Version of message */
- if (p + 1 - 1 > p_end) /* one byte for version */
- HGOTO_ERROR(H5E_OHDR, H5E_NOSPACE, NULL, "ran off end of input buffer while decoding")
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
vers = *p++;
if (vers == H5O_FSINFO_VERSION_0) {
@@ -129,8 +122,8 @@ H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
fsinfo->pgend_meta_thres = H5F_FILE_SPACE_PGEND_META_THRES;
fsinfo->eoa_pre_fsm_fsalloc = HADDR_UNDEF;
- if (p + 1 + H5F_SIZEOF_SIZE(f) - 1 > p_end) /* one byte for strategy + sizeof(f) */
- HGOTO_ERROR(H5E_OHDR, H5E_NOSPACE, NULL, "ran off end of input buffer while decoding")
+ if (H5_IS_BUFFER_OVERFLOW(p, 1 + H5F_sizeof_size(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
strategy = (H5F_file_space_type_t)*p++; /* File space strategy */
H5F_DECODE_LENGTH(f, p, threshold); /* Free-space section threshold */
@@ -143,9 +136,9 @@ H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
if (HADDR_UNDEF == (fsinfo->eoa_pre_fsm_fsalloc = H5F_get_eoa(f, H5FD_MEM_DEFAULT)))
HGOTO_ERROR(H5E_FILE, H5E_CANTGET, NULL, "unable to get file size")
for (type = H5FD_MEM_SUPER; type < H5FD_MEM_NTYPES; type++) {
- if (p + H5_SIZEOF_HADDR_T > p_end)
- HGOTO_ERROR(H5E_FILE, H5E_CANTDECODE, NULL,
- "ran off end of input buffer while decoding")
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
+ "ran off end of input buffer while decoding");
H5F_addr_decode(f, &p, &(fsinfo->fs_addr[type - 1]));
}
break;
@@ -167,32 +160,43 @@ H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
case H5F_FILE_SPACE_DEFAULT:
default:
HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, NULL, "invalid file space strategy")
- } /* end switch */
+ }
fsinfo->version = H5O_FSINFO_VERSION_1;
fsinfo->mapped = TRUE;
}
else {
- HDassert(vers >= H5O_FSINFO_VERSION_1);
+ if (vers < H5O_FSINFO_VERSION_1)
+ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, NULL, "bad version number")
fsinfo->version = vers;
- /* strategy (1) + persist (1) + sizeof(f) + sizeof(f) + pgend_meta_thres (2) + sizeofaddr(f) */
- if (p + 1 + 1 + 2 * H5F_SIZEOF_SIZE(f) + 2 + H5F_SIZEOF_ADDR(f) - 1 > p_end)
- HGOTO_ERROR(H5E_OHDR, H5E_NOSPACE, NULL, "ran off end of input buffer while decoding")
+ if (H5_IS_BUFFER_OVERFLOW(p, 1 + 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
fsinfo->strategy = (H5F_fspace_strategy_t)*p++; /* File space strategy */
fsinfo->persist = *p++; /* Free-space persist or not */
- H5F_DECODE_LENGTH(f, p, fsinfo->threshold); /* Free-space section threshold */
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
+ H5F_DECODE_LENGTH(f, p, fsinfo->threshold); /* Free-space section threshold */
+
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_DECODE_LENGTH(f, p, fsinfo->page_size); /* File space page size */
- UINT16DECODE(p, fsinfo->pgend_meta_thres); /* Page end metadata threshold */
+
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
+ UINT16DECODE(p, fsinfo->pgend_meta_thres); /* Page end metadata threshold */
+
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_addr_decode(f, &p,
&(fsinfo->eoa_pre_fsm_fsalloc)); /* EOA before free-space header and section info */
/* Decode addresses of free space managers, if persisting */
if (fsinfo->persist)
for (ptype = H5F_MEM_PAGE_SUPER; ptype < H5F_MEM_PAGE_NTYPES; ptype++) {
- if (p + H5F_SIZEOF_SIZE(f) - 1 > p_end) /* one byte for sizeof(f) */
- HGOTO_ERROR(H5E_OHDR, H5E_NOSPACE, NULL, "ran off end of input buffer while decoding")
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_addr_decode(f, &p, &(fsinfo->fs_addr[ptype - 1]));
}
fsinfo->mapped = FALSE;
@@ -202,8 +206,8 @@ H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
ret_value = fsinfo;
done:
- if (ret_value == NULL && fsinfo != NULL)
- fsinfo = H5FL_FREE(H5O_fsinfo_t, fsinfo);
+ if (!ret_value && fsinfo)
+ H5FL_FREE(H5O_fsinfo_t, fsinfo);
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__fsinfo_decode() */
diff --git a/src/H5Oginfo.c b/src/H5Oginfo.c
index 54d8b8b..df45e53 100644
--- a/src/H5Oginfo.c
+++ b/src/H5Oginfo.c
@@ -13,10 +13,8 @@
/*-------------------------------------------------------------------------
*
* Created: H5Oginfo.c
- * Aug 23 2005
- * Quincey Koziol
*
- * Purpose: Group Information messages.
+ * Purpose: Group Information messages
*
*-------------------------------------------------------------------------
*/
@@ -78,34 +76,24 @@ H5FL_DEFINE_STATIC(H5O_ginfo_t);
* Purpose: Decode a message and return a pointer to
* a newly allocated one.
*
- * Return: Success: Ptr to new message in native order.
- *
- * Failure: NULL
- *
- * Programmer: Quincey Koziol
- * Aug 30 2005
- *
+ * Return: Success: Pointer to new message in native order
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
H5O__ginfo_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
unsigned H5_ATTR_UNUSED *ioflags, size_t p_size, const uint8_t *p)
{
- H5O_ginfo_t *ginfo = NULL; /* Pointer to group information message */
- unsigned char flags; /* Flags for encoding group info */
- void *ret_value = NULL; /* Return value */
+ H5O_ginfo_t *ginfo = NULL; /* Pointer to group information message */
+ unsigned char flags; /* Flags for encoding group info */
+ const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* check args */
+ HDassert(f);
HDassert(p);
- if (p_size == 0)
- HGOTO_ERROR(H5E_OHDR, H5E_ARGS, NULL, "size of given ginfo was zero")
-
- /* Points at last valid byte in buffer */
- const uint8_t *p_end = p + p_size - 1;
-
/* Version of message */
if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
@@ -132,11 +120,11 @@ H5O__ginfo_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh, unsign
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, ginfo->max_compact)
UINT16DECODE(p, ginfo->min_dense)
- } /* end if */
+ }
else {
ginfo->max_compact = H5G_CRT_GINFO_MAX_COMPACT;
ginfo->min_dense = H5G_CRT_GINFO_MIN_DENSE;
- } /* end else */
+ }
/* Get the estimated # of entries & name lengths */
if (ginfo->store_est_entry_info) {
@@ -144,19 +132,18 @@ H5O__ginfo_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh, unsign
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, ginfo->est_num_entries)
UINT16DECODE(p, ginfo->est_name_len)
- } /* end if */
+ }
else {
ginfo->est_num_entries = H5G_CRT_GINFO_EST_NUM_ENTRIES;
ginfo->est_name_len = H5G_CRT_GINFO_EST_NAME_LEN;
- } /* end if */
+ }
/* Set return value */
ret_value = ginfo;
done:
- if (ret_value == NULL)
- if (ginfo != NULL)
- ginfo = H5FL_FREE(H5O_ginfo_t, ginfo);
+ if (!ret_value && ginfo)
+ H5FL_FREE(H5O_ginfo_t, ginfo);
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__ginfo_decode() */
diff --git a/src/H5Olayout.c b/src/H5Olayout.c
index a58fc0c..f784f24 100644
--- a/src/H5Olayout.c
+++ b/src/H5Olayout.c
@@ -10,10 +10,8 @@
* help@hdfgroup.org. *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
-/* Programmer: Robb Matzke
- * Wednesday, October 8, 1997
- *
- * Purpose: Messages related to data layout.
+/*
+ * Purpose: Messages related to data layout
*/
#define H5D_FRIEND /*suppress error about including H5Dpkg */
@@ -78,13 +76,8 @@ H5FL_DEFINE(H5O_layout_t);
* Purpose: Decode an data layout message and return a pointer to a
* new one created with malloc().
*
- * Return: Success: Ptr to new message in native order.
- *
+ * Return: Success: Pointer to new message in native order
* Failure: NULL
- *
- * Programmer: Robb Matzke
- * Wednesday, October 8, 1997
- *
*-------------------------------------------------------------------------
*/
static void *
@@ -94,16 +87,13 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
H5O_layout_t *mesg = NULL;
uint8_t *heap_block = NULL;
- unsigned u;
- void *ret_value = NULL; /* Return value */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* check args */
HDassert(f);
HDassert(p);
- /* decode */
if (NULL == (mesg = H5FL_CALLOC(H5O_layout_t)))
HGOTO_ERROR(H5E_RESOURCE, H5E_CANTALLOC, NULL, "memory allocation failed")
mesg->storage.type = H5D_LAYOUT_ERROR;
@@ -144,33 +134,33 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
/* Address */
if (mesg->type == H5D_CONTIGUOUS) {
- if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_ADDR(f), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
H5F_addr_decode(f, &p, &(mesg->storage.u.contig.addr));
/* Set the layout operations */
mesg->ops = H5D_LOPS_CONTIG;
- } /* end if */
+ }
else if (mesg->type == H5D_CHUNKED) {
- if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_ADDR(f), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
H5F_addr_decode(f, &p, &(mesg->storage.u.chunk.idx_addr));
/* Set the layout operations */
mesg->ops = H5D_LOPS_CHUNK;
- /* Set the chunk operations */
- /* (Only "btree" indexing type currently supported in this version) */
+ /* Set the chunk operations
+ * (Only "btree" indexing type currently supported in this version)
+ */
mesg->storage.u.chunk.idx_type = H5D_CHUNK_IDX_BTREE;
mesg->storage.u.chunk.ops = H5D_COPS_BTREE;
- } /* end if */
- else {
- /* Sanity check */
- HDassert(mesg->type == H5D_COMPACT);
-
+ }
+ else if (mesg->type == H5D_COMPACT) {
/* Set the layout operations */
mesg->ops = H5D_LOPS_COMPACT;
- } /* end else */
+ }
+ else
+ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "invalid layout type")
/* Read the size */
if (mesg->type != H5D_CHUNKED) {
@@ -178,24 +168,24 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
* truncation of the dimension sizes when they were stored in this
* version of the layout message. Compute the contiguous storage
* size in the dataset code, where we've got the dataspace
- * information available also. - QAK 5/26/04
+ * information available also.
*/
- if (H5_IS_BUFFER_OVERFLOW(p, (ndims * sizeof(uint32_t)), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, (ndims * 4), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
p += ndims * sizeof(uint32_t); /* Skip over dimension sizes */
- } /* end if */
+ }
else {
if (ndims < 2)
HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "bad dimensions for chunked storage")
mesg->u.chunk.ndims = ndims;
- if (H5_IS_BUFFER_OVERFLOW(p, (ndims * sizeof(uint32_t)), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, (ndims * 4), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
+ for (unsigned u = 0; u < ndims; u++) {
- for (u = 0; u < ndims; u++) {
UINT32DECODE(p, mesg->u.chunk.dim[u]);
- /* Just in case that something goes very wrong, such as file corruption. */
+ /* Just in case that something goes very wrong, such as file corruption */
if (mesg->u.chunk.dim[u] == 0)
HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL,
"bad chunk dimension value when parsing layout message - chunk dimension "
@@ -204,12 +194,13 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
}
/* Compute chunk size */
- for (u = 1, mesg->u.chunk.size = mesg->u.chunk.dim[0]; u < ndims; u++)
+ mesg->u.chunk.size = mesg->u.chunk.dim[0];
+ for (unsigned u = 1; u < ndims; u++)
mesg->u.chunk.size *= mesg->u.chunk.dim[u];
- } /* end if */
+ }
if (mesg->type == H5D_COMPACT) {
- if (H5_IS_BUFFER_OVERFLOW(p, sizeof(uint32_t), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT32DECODE(p, mesg->storage.u.compact.size);
@@ -223,9 +214,9 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
"memory allocation failed for compact data buffer")
H5MM_memcpy(mesg->storage.u.compact.buf, p, mesg->storage.u.compact.size);
p += mesg->storage.u.compact.size;
- } /* end if */
- } /* end if */
- } /* end if */
+ }
+ }
+ }
else {
/* Layout & storage class */
if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
@@ -236,7 +227,7 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
switch (mesg->type) {
case H5D_COMPACT:
/* Compact data size */
- if (H5_IS_BUFFER_OVERFLOW(p, sizeof(uint16_t), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, mesg->storage.u.compact.size);
@@ -254,7 +245,7 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
/* Compact data */
H5MM_memcpy(mesg->storage.u.compact.buf, p, mesg->storage.u.compact.size);
p += mesg->storage.u.compact.size;
- } /* end if */
+ }
/* Set the layout operations */
mesg->ops = H5D_LOPS_COMPACT;
@@ -262,12 +253,12 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
case H5D_CONTIGUOUS:
/* Contiguous storage address */
- if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_ADDR(f), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
H5F_addr_decode(f, &p, &(mesg->storage.u.contig.addr));
/* Contiguous storage size */
- if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_SIZE(f), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
H5F_DECODE_LENGTH(f, p, mesg->storage.u.contig.size);
@@ -292,17 +283,18 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "bad dimensions for chunked storage")
/* B-tree address */
- if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_ADDR(f), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
"ran off end of input buffer while decoding")
H5F_addr_decode(f, &p, &(mesg->storage.u.chunk.idx_addr));
- if (H5_IS_BUFFER_OVERFLOW(p, (mesg->u.chunk.ndims * sizeof(uint32_t)), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, (mesg->u.chunk.ndims * 4), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
"ran off end of input buffer while decoding")
/* Chunk dimensions */
- for (u = 0; u < mesg->u.chunk.ndims; u++) {
+ for (unsigned u = 0; u < mesg->u.chunk.ndims; u++) {
+
UINT32DECODE(p, mesg->u.chunk.dim[u]);
/* Just in case that something goes very wrong, such as file corruption. */
@@ -311,17 +303,19 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
"bad chunk dimension value when parsing layout message - chunk "
"dimension must be positive: mesg->u.chunk.dim[%u] = %u",
u, mesg->u.chunk.dim[u])
- } /* end for */
+ }
/* Compute chunk size */
- for (u = 1, mesg->u.chunk.size = mesg->u.chunk.dim[0]; u < mesg->u.chunk.ndims; u++)
+ mesg->u.chunk.size = mesg->u.chunk.dim[0];
+ for (unsigned u = 1; u < mesg->u.chunk.ndims; u++)
mesg->u.chunk.size *= mesg->u.chunk.dim[u];
- /* Set the chunk operations */
- /* (Only "btree" indexing type supported with v3 of message format) */
+ /* Set the chunk operations
+ * (Only "btree" indexing type supported with v3 of message format)
+ */
mesg->storage.u.chunk.idx_type = H5D_CHUNK_IDX_BTREE;
mesg->storage.u.chunk.ops = H5D_COPS_BTREE;
- } /* end if */
+ }
else {
/* Get the chunked layout flags */
if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
@@ -360,7 +354,7 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
"ran off end of input buffer while decoding")
/* Chunk dimensions */
- for (u = 0; u < mesg->u.chunk.ndims; u++) {
+ for (unsigned u = 0; u < mesg->u.chunk.ndims; u++) {
UINT64DECODE_VAR(p, mesg->u.chunk.dim[u], mesg->u.chunk.enc_bytes_per_dim);
/* Just in case that something goes very wrong, such as file corruption. */
@@ -372,7 +366,8 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
}
/* Compute chunk size */
- for (u = 1, mesg->u.chunk.size = mesg->u.chunk.dim[0]; u < mesg->u.chunk.ndims; u++)
+ mesg->u.chunk.size = mesg->u.chunk.dim[0];
+ for (unsigned u = 1; u < mesg->u.chunk.ndims; u++)
mesg->u.chunk.size *= mesg->u.chunk.dim[u];
/* Chunk index type */
@@ -397,12 +392,12 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
case H5D_CHUNK_IDX_SINGLE: /* Single Chunk Index */
if (mesg->u.chunk.flags & H5O_LAYOUT_CHUNK_SINGLE_INDEX_WITH_FILTER) {
- if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_SIZE(f) + sizeof(uint32_t), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f) + 4, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
"ran off end of input buffer while decoding")
H5F_DECODE_LENGTH(f, p, mesg->storage.u.chunk.u.single.nbytes);
UINT32DECODE(p, mesg->storage.u.chunk.u.single.filter_mask);
- } /* end if */
+ }
/* Set the chunk operations */
mesg->storage.u.chunk.ops = H5D_COPS_SINGLE;
@@ -475,7 +470,7 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
break;
case H5D_CHUNK_IDX_BT2: /* v2 B-tree index */
- if (H5_IS_BUFFER_OVERFLOW(p, sizeof(uint32_t), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
"ran off end of input buffer while decoding")
UINT32DECODE(p, mesg->u.chunk.u.btree2.cparam.node_size);
@@ -511,14 +506,14 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
case H5D_CHUNK_IDX_NTYPES:
default:
HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "Invalid chunk index type")
- } /* end switch */
+ }
/* Chunk index address */
- if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_ADDR(f), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
"ran off end of input buffer while decoding")
H5F_addr_decode(f, &p, &(mesg->storage.u.chunk.idx_addr));
- } /* end else */
+ }
/* Set the layout operations */
mesg->ops = H5D_LOPS_CHUNK;
@@ -530,12 +525,12 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
HGOTO_ERROR(H5E_OHDR, H5E_VERSION, NULL, "invalid layout version with virtual layout")
/* Heap information */
- if (H5_IS_BUFFER_OVERFLOW(p, H5F_SIZEOF_ADDR(f), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
H5F_addr_decode(f, &p, &(mesg->storage.u.virt.serial_list_hobjid.addr));
/* NOTE: virtual mapping global heap entry address could be undefined */
- if (H5_IS_BUFFER_OVERFLOW(p, sizeof(uint32_t), p_end))
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT32DECODE(p, mesg->storage.u.virt.serial_list_hobjid.idx);
@@ -580,7 +575,7 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
(unsigned)H5O_LAYOUT_VDS_GH_ENC_VERS, (unsigned)heap_vers)
/* Number of entries */
- if (H5_IS_BUFFER_OVERFLOW(heap_block_p, H5F_SIZEOF_SIZE(f), heap_block_p_end))
+ if (H5_IS_BUFFER_OVERFLOW(heap_block_p, H5F_sizeof_size(f), heap_block_p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
"ran off end of input buffer while decoding")
H5F_DECODE_LENGTH(f, heap_block_p, tmp_hsize)
@@ -679,9 +674,9 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
else
mesg->storage.u.virt.list[i].source_dset.dset_name =
mesg->storage.u.virt.list[i].source_dset_name;
- } /* end if */
+ }
- /* unlim_dim fields */
+ /* Unlim_dim fields */
mesg->storage.u.virt.list[i].unlim_dim_source =
H5S_get_select_unlim_dim(mesg->storage.u.virt.list[i].source_select);
mesg->storage.u.virt.list[i].unlim_dim_virtual =
@@ -697,7 +692,7 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
mesg->storage.u.virt.list[i].source_select;
mesg->storage.u.virt.list[i].source_dset.clipped_virtual_select =
mesg->storage.u.virt.list[i].source_dset.virtual_select;
- } /* end if */
+ }
/* Check mapping for validity (do both pre and post
* checks here, since we had to allocate the entry list
@@ -713,10 +708,10 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
if (H5D_virtual_update_min_dims(mesg, i) < 0)
HGOTO_ERROR(H5E_OHDR, H5E_CANTINIT, NULL,
"unable to update virtual dataset minimum dimensions")
- } /* end for */
+ }
/* Read stored checksum */
- if (H5_IS_BUFFER_OVERFLOW(heap_block_p, sizeof(uint32_t), heap_block_p_end))
+ if (H5_IS_BUFFER_OVERFLOW(heap_block_p, 4, heap_block_p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
"ran off end of input buffer while decoding")
UINT32DECODE(heap_block_p, stored_chksum)
@@ -743,8 +738,8 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
case H5D_NLAYOUTS:
default:
HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "Invalid layout class")
- } /* end switch */
- } /* end else */
+ }
+ }
/* Set return value */
ret_value = mesg;
@@ -755,8 +750,8 @@ done:
if (mesg->type == H5D_VIRTUAL)
if (H5D__virtual_reset_layout(mesg) < 0)
HDONE_ERROR(H5E_OHDR, H5E_CANTFREE, NULL, "unable to reset virtual layout")
- mesg = H5FL_FREE(H5O_layout_t, mesg);
- } /* end if */
+ H5FL_FREE(H5O_layout_t, mesg);
+ }
heap_block = (uint8_t *)H5MM_xfree(heap_block);
diff --git a/src/H5Olinfo.c b/src/H5Olinfo.c
index 11138df..a82be72 100644
--- a/src/H5Olinfo.c
+++ b/src/H5Olinfo.c
@@ -13,16 +13,14 @@
/*-------------------------------------------------------------------------
*
* Created: H5Olinfo.c
- * Aug 23 2005
- * Quincey Koziol
*
- * Purpose: Link Information messages.
+ * Purpose: Link information messages
*
*-------------------------------------------------------------------------
*/
-#define H5G_FRIEND /*suppress error about including H5Gpkg */
-#define H5L_FRIEND /*suppress error about including H5Lpkg */
+#define H5G_FRIEND /* Suppress error about including H5Gpkg */
+#define H5L_FRIEND /* Suppress error about including H5Lpkg */
#include "H5Omodule.h" /* This source code file is part of the H5O module */
#include "H5private.h" /* Generic Functions */
@@ -95,12 +93,8 @@ H5FL_DEFINE_STATIC(H5O_linfo_t);
*
* Purpose: Decode a message and return a pointer to a newly allocated one.
*
- * Return: Success: Ptr to new message in native form.
+ * Return: Success: Pointer to new message in native form
* Failure: NULL
- *
- * Programmer: Quincey Koziol
- * Aug 23 2005
- *
*-------------------------------------------------------------------------
*/
static void *
@@ -115,7 +109,6 @@ H5O__linfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUS
FUNC_ENTER_PACKAGE
- /* check args */
HDassert(f);
HDassert(p);
diff --git a/src/H5Olink.c b/src/H5Olink.c
index dabf87e..160b1d0 100644
--- a/src/H5Olink.c
+++ b/src/H5Olink.c
@@ -13,10 +13,8 @@
/*-------------------------------------------------------------------------
*
* Created: H5Olink.c
- * Aug 29 2005
- * Quincey Koziol
*
- * Purpose: Link messages.
+ * Purpose: Link messages
*
*-------------------------------------------------------------------------
*/
@@ -100,32 +98,27 @@ H5FL_DEFINE_STATIC(H5O_link_t);
* Purpose: Decode a message and return a pointer to
* a newly allocated one.
*
- * Return: Success: Ptr to new message in native order.
- *
- * Failure: NULL
- *
- * Programmer: Quincey Koziol
- * Aug 29 2005
- *
+ * Return: Success: Pointer to new message in native order
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
unsigned H5_ATTR_UNUSED *ioflags, size_t p_size, const uint8_t *p)
{
- H5O_link_t *lnk = NULL; /* Pointer to link message */
- size_t len = 0; /* Length of a string in the message */
- unsigned char link_flags; /* Flags for encoding link info */
- const uint8_t *p_end = p + p_size; /* End of the p buffer */
- void *ret_value = NULL; /* Return value */
+ H5O_link_t *lnk = NULL; /* Pointer to link message */
+ size_t len = 0; /* Length of a string in the message */
+ unsigned char link_flags; /* Flags for encoding link info */
+ const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* check args */
HDassert(f);
HDassert(p);
- /* decode */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
if (*p++ != H5O_LINK_VERSION)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "bad version number for message")
@@ -134,6 +127,8 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
/* Get the encoding flags for the link */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
link_flags = *p++;
if (link_flags & ~H5O_LINK_ALL_FLAGS)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "bad flag value for message")
@@ -141,63 +136,74 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
/* Check for non-default link type */
if (link_flags & H5O_LINK_STORE_LINK_TYPE) {
/* Get the type of the link */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
lnk->type = (H5L_type_t)*p++;
if (lnk->type < H5L_TYPE_HARD || lnk->type > H5L_TYPE_MAX)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "bad link type")
- } /* end if */
+ }
else
lnk->type = H5L_TYPE_HARD;
/* Get the link creation time from the file */
if (link_flags & H5O_LINK_STORE_CORDER) {
+ if (H5_IS_BUFFER_OVERFLOW(p, 8, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
INT64DECODE(p, lnk->corder)
lnk->corder_valid = TRUE;
- } /* end if */
+ }
else {
lnk->corder = 0;
lnk->corder_valid = FALSE;
- } /* end else */
+ }
/* Check for non-default name character set */
if (link_flags & H5O_LINK_STORE_NAME_CSET) {
/* Get the link name's character set */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
lnk->cset = (H5T_cset_t)*p++;
if (lnk->cset < H5T_CSET_ASCII || lnk->cset > H5T_CSET_UTF8)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "bad cset type")
- } /* end if */
+ }
else
lnk->cset = H5T_CSET_ASCII;
/* Get the length of the link's name */
switch (link_flags & H5O_LINK_NAME_SIZE) {
case 0: /* 1 byte size */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
len = *p++;
break;
case 1: /* 2 byte size */
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, len);
break;
case 2: /* 4 byte size */
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT32DECODE(p, len);
break;
case 3: /* 8 byte size */
+ if (H5_IS_BUFFER_OVERFLOW(p, 8, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT64DECODE(p, len);
break;
default:
- HDassert(0 && "bad size for name");
- } /* end switch */
+ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "no appropriate size for name length")
+ }
if (len == 0)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "invalid name length")
- /* Make sure that length doesn't exceed buffer size, which could occur
- when the file is corrupted */
- if (p + len > p_end)
- HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "name length causes read past end of buffer")
-
/* Get the link's name */
+ if (H5_IS_BUFFER_OVERFLOW(p, len, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
if (NULL == (lnk->name = (char *)H5MM_malloc(len + 1)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
H5MM_memcpy(lnk->name, p, len);
@@ -208,20 +214,21 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
switch (lnk->type) {
case H5L_TYPE_HARD:
/* Get the address of the object the link points to */
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
H5F_addr_decode(f, &p, &(lnk->u.hard.addr));
break;
case H5L_TYPE_SOFT:
/* Get the link value */
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, len)
if (len == 0)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "invalid link length")
- /* Make sure that length doesn't exceed buffer size, which could occur
- when the file is corrupted */
- if (p + len > p_end)
- HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "name length causes read past end of buffer")
-
+ if (H5_IS_BUFFER_OVERFLOW(p, len, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
if (NULL == (lnk->u.soft.name = (char *)H5MM_malloc((size_t)len + 1)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
H5MM_memcpy(lnk->u.soft.name, p, len);
@@ -238,16 +245,15 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "unknown link type")
/* A UD link. Get the user-supplied data */
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, len)
if (lnk->type == H5L_TYPE_EXTERNAL && len < 3)
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "external link information length < 3")
lnk->u.ud.size = len;
if (len > 0) {
- /* Make sure that length doesn't exceed buffer size, which could
- occur when the file is corrupted */
- if (p + len > p_end)
- HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "name length causes read past end of buffer")
-
+ if (H5_IS_BUFFER_OVERFLOW(p, len, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
if (NULL == (lnk->u.ud.udata = H5MM_malloc((size_t)len)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
H5MM_memcpy(lnk->u.ud.udata, p, len);
@@ -255,22 +261,20 @@ H5O__link_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSE
}
else
lnk->u.ud.udata = NULL;
- } /* end switch */
+ }
/* Set return value */
ret_value = lnk;
done:
- if (ret_value == NULL)
- if (lnk != NULL) {
- if (lnk->name != NULL)
- H5MM_xfree(lnk->name);
- if (lnk->type == H5L_TYPE_SOFT && lnk->u.soft.name != NULL)
- H5MM_xfree(lnk->u.soft.name);
- if (lnk->type >= H5L_TYPE_UD_MIN && lnk->u.ud.size > 0 && lnk->u.ud.udata != NULL)
- H5MM_xfree(lnk->u.ud.udata);
- lnk = H5FL_FREE(H5O_link_t, lnk);
- } /* end if */
+ if (!ret_value && lnk) {
+ H5MM_xfree(lnk->name);
+ if (lnk->type == H5L_TYPE_SOFT && lnk->u.soft.name != NULL)
+ H5MM_xfree(lnk->u.soft.name);
+ if (lnk->type >= H5L_TYPE_UD_MIN && lnk->u.ud.size > 0 && lnk->u.ud.udata != NULL)
+ H5MM_xfree(lnk->u.ud.udata);
+ H5FL_FREE(H5O_link_t, lnk);
+ }
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__link_decode() */
diff --git a/src/H5Opline.c b/src/H5Opline.c
index 4ccd96c..711a67b 100644
--- a/src/H5Opline.c
+++ b/src/H5Opline.c
@@ -11,10 +11,7 @@
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/*
- * Programmer: Robb Matzke
- * Wednesday, April 15, 1998
- *
- * Purpose: Data filter pipeline message.
+ * Purpose: Data filter pipeline message
*/
#include "H5Omodule.h" /* This source code file is part of the H5O module */
@@ -103,12 +100,8 @@ H5FL_DEFINE(H5O_pline_t);
*
* Purpose: Decodes a filter pipeline message.
*
- * Return: Success: Ptr to the native message.
+ * Return: Success: Pointer to a new pipeline message
* Failure: NULL
- *
- * Programmer: Robb Matzke
- * Wednesday, April 15, 1998
- *
*-------------------------------------------------------------------------
*/
@@ -121,11 +114,11 @@ H5O__pline_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh, unsign
size_t name_length; /* Length of filter name */
size_t i; /* Local index variable */
const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
- void *ret_value = NULL; /* Return value */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* check args */
+ HDassert(f);
HDassert(p);
/* Allocate space for I/O pipeline message */
@@ -133,14 +126,15 @@ H5O__pline_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh, unsign
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
/* Version */
- if (p + 4 - 1 > p_end) /* 4 byte is minimum for all versions */
- HGOTO_ERROR(H5E_OHDR, H5E_NOSPACE, NULL, "ran off the end of the buffer: current p = %p, p_end = %p",
- (const void *)(p + 4), (const void *)p_end)
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
pline->version = *p++;
if (pline->version < H5O_PLINE_VERSION_1 || pline->version > H5O_PLINE_VERSION_LATEST)
HGOTO_ERROR(H5E_PLINE, H5E_CANTLOAD, NULL, "bad version number for filter pipeline message")
/* Number of filters */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
pline->nused = *p++;
if (pline->nused > H5Z_MAX_NFILTERS) {
@@ -153,8 +147,11 @@ H5O__pline_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh, unsign
}
/* Reserved */
- if (pline->version == H5O_PLINE_VERSION_1)
+ if (pline->version == H5O_PLINE_VERSION_1) {
+ if (H5_IS_BUFFER_OVERFLOW(p, 6, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
p += 6;
+ }
/* Allocate array for filters */
pline->nalloc = pline->nused;
@@ -164,94 +161,95 @@ H5O__pline_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh, unsign
/* Decode filters */
for (i = 0, filter = &pline->filter[0]; i < pline->nused; i++, filter++) {
/* Filter ID */
- if (p + 6 - 1 > p_end) /* 6 bytes minimum */
- HGOTO_ERROR(H5E_OHDR, H5E_NOSPACE, NULL,
- "ran off the end of the buffer: current p = %p, p_end = %p", (const void *)(p + 6),
- (const void *)p_end)
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, filter->id);
/* Length of filter name */
if (pline->version > H5O_PLINE_VERSION_1 && filter->id < H5Z_FILTER_RESERVED)
name_length = 0;
else {
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, name_length);
if (pline->version == H5O_PLINE_VERSION_1 && name_length % 8)
HGOTO_ERROR(H5E_PLINE, H5E_CANTLOAD, NULL, "filter name length is not a multiple of eight")
- if (p + 4 - 1 > p_end) /* with name_length 4 bytes to go */
- HGOTO_ERROR(H5E_OHDR, H5E_NOSPACE, NULL,
- "ran off the end of the buffer: current p = %p, p_end = %p",
- (const void *)(p + 4), (const void *)p_end)
- } /* end if */
+ }
/* Filter flags */
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, filter->flags);
/* Number of filter parameters ("client data elements") */
+ if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT16DECODE(p, filter->cd_nelmts);
/* Filter name, if there is one */
if (name_length) {
- size_t actual_name_length; /* Actual length of name */
- size_t len = (size_t)(p_end - p + 1);
+ size_t actual_name_length; /* Actual length of name */
+ size_t max = (size_t)(p_end - p + 1); /* Max possible name length */
+
/* Determine actual name length (without padding, but with null terminator) */
- actual_name_length = HDstrnlen((const char *)p, len);
- if (actual_name_length == len)
+ actual_name_length = HDstrnlen((const char *)p, max);
+ if (actual_name_length == max)
HGOTO_ERROR(H5E_OHDR, H5E_NOSPACE, NULL, "filter name not null terminated")
actual_name_length += 1; /* include \0 byte */
- HDassert(actual_name_length <= name_length);
/* Allocate space for the filter name, or use the internal buffer */
if (actual_name_length > H5Z_COMMON_NAME_LEN) {
filter->name = (char *)H5MM_malloc(actual_name_length);
if (NULL == filter->name)
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for filter name")
- } /* end if */
+ }
else
filter->name = filter->_name;
HDstrncpy(filter->name, (const char *)p, actual_name_length);
+
+ if (H5_IS_BUFFER_OVERFLOW(p, name_length, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
p += name_length;
- } /* end if */
+ }
/* Filter parameters */
if (filter->cd_nelmts) {
- size_t j; /* Local index variable */
/* Allocate space for the client data elements, or use the internal buffer */
if (filter->cd_nelmts > H5Z_COMMON_CD_VALUES) {
filter->cd_values = (unsigned *)H5MM_malloc(filter->cd_nelmts * sizeof(unsigned));
if (NULL == filter->cd_values)
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed for client data")
- } /* end if */
+ }
else
filter->cd_values = filter->_cd_values;
- /*
- * Read the client data values and the padding
- */
- for (j = 0; j < filter->cd_nelmts; j++) {
- if (p + 4 - 1 <= p_end)
- UINT32DECODE(p, filter->cd_values[j])
- else
- HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL,
- "ran off the end of the buffer: current p = %p, p_size = %zu, p_end = %p",
- (const void *)p, p_size, (const void *)p_end)
+ /* Read the client data values and the padding */
+ for (size_t j = 0; j < filter->cd_nelmts; j++) {
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
+ UINT32DECODE(p, filter->cd_values[j])
}
if (pline->version == H5O_PLINE_VERSION_1)
- if (filter->cd_nelmts % 2)
- p += 4; /*padding*/
- } /* end if */
- } /* end for */
+ if (filter->cd_nelmts % 2) {
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL,
+ "ran off end of input buffer while decoding")
+ p += 4; /* padding */
+ }
+ }
+ }
/* Set return value */
ret_value = pline;
done:
- if (NULL == ret_value && pline) {
+ if (!ret_value && pline) {
H5O__pline_reset(pline);
H5O__pline_free(pline);
- } /* end if */
+ }
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__pline_decode() */
diff --git a/src/H5Orefcount.c b/src/H5Orefcount.c
index 51da22c..f4d3b5c 100644
--- a/src/H5Orefcount.c
+++ b/src/H5Orefcount.c
@@ -13,10 +13,8 @@
/*-------------------------------------------------------------------------
*
* Created: H5Orefcount.c
- * Mar 10 2007
- * Quincey Koziol
*
- * Purpose: Object ref. count messages.
+ * Purpose: Object reference count messages
*
*-------------------------------------------------------------------------
*/
@@ -72,31 +70,30 @@ H5FL_DEFINE_STATIC(H5O_refcount_t);
/*-------------------------------------------------------------------------
* Function: H5O__refcount_decode
*
- * Purpose: Decode a message and return a pointer to a newly allocated one.
- *
- * Return: Success: Ptr to new message in native form.
- * Failure: NULL
- *
- * Programmer: Quincey Koziol
- * Mar 10 2007
+ * Purpose: Decode a message and return a pointer to a newly allocated
+ * one.
*
+ * Return: Success: Pointer to new message in native form
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
H5O__refcount_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
- unsigned H5_ATTR_UNUSED mesg_flags, unsigned H5_ATTR_UNUSED *ioflags,
- size_t H5_ATTR_UNUSED p_size, const uint8_t *p)
+ unsigned H5_ATTR_UNUSED mesg_flags, unsigned H5_ATTR_UNUSED *ioflags, size_t p_size,
+ const uint8_t *p)
{
- H5O_refcount_t *refcount = NULL; /* Reference count */
- void *ret_value = NULL; /* Return value */
+ H5O_refcount_t *refcount = NULL; /* Reference count */
+ const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* check args */
HDassert(f);
HDassert(p);
/* Version of message */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
if (*p++ != H5O_REFCOUNT_VERSION)
HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "bad version number for message")
@@ -104,15 +101,17 @@ H5O__refcount_decode(H5F_t H5_ATTR_UNUSED *f, H5O_t H5_ATTR_UNUSED *open_oh,
if (NULL == (refcount = H5FL_MALLOC(H5O_refcount_t)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
- /* Get ref. count for object */
+ /* Get reference count for object */
+ if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
UINT32DECODE(p, *refcount)
/* Set return value */
ret_value = refcount;
done:
- if (ret_value == NULL && refcount != NULL)
- refcount = H5FL_FREE(H5O_refcount_t, refcount);
+ if (!ret_value && refcount)
+ H5FL_FREE(H5O_refcount_t, refcount);
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__refcount_decode() */
diff --git a/src/H5Osdspace.c b/src/H5Osdspace.c
index e9a0dc6..9bf5d6f 100644
--- a/src/H5Osdspace.c
+++ b/src/H5Osdspace.c
@@ -115,11 +115,9 @@ H5O__sdspace_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UN
FUNC_ENTER_PACKAGE
- /* check args */
HDassert(f);
HDassert(p);
- /* decode */
if (NULL == (sdim = H5FL_CALLOC(H5S_extent_t)))
HGOTO_ERROR(H5E_DATASPACE, H5E_CANTALLOC, NULL, "dataspace structure allocation failed")
sdim->type = H5S_NO_CLASS;
@@ -154,9 +152,11 @@ H5O__sdspace_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UN
if (sdim->type != H5S_SIMPLE && sdim->rank > 0)
HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "invalid rank for scalar or NULL dataspace")
- } /* end if */
+ }
else {
- /* Set the dataspace type to be simple or scalar as appropriate */
+ /* Set the dataspace type to be simple or scalar as appropriate
+ * (version 1 does not allow H5S_NULL)
+ */
if (sdim->rank > 0)
sdim->type = H5S_SIMPLE;
else
@@ -166,50 +166,46 @@ H5O__sdspace_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UN
if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
p++;
- } /* end else */
- HDassert(sdim->type != H5S_NULL || sdim->version >= H5O_SDSPACE_VERSION_2);
+ }
- /* Only Version 1 has these reserved bytes */
+ /* Version 1 has 4 reserved bytes */
if (version == H5O_SDSPACE_VERSION_1) {
if (H5_IS_BUFFER_OVERFLOW(p, 4, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
- p += 4; /*reserved*/
+ p += 4;
}
/* Decode dimension sizes */
if (sdim->rank > 0) {
- uint8_t sizeof_size = H5F_SIZEOF_SIZE(f);
- /*
- * Ensure that decoding doesn't cause reading past buffer's end,
- * due to possible data corruption - check that we have space to
- * decode a "sdim->rank" number of hsize_t values
- */
- if (H5_IS_BUFFER_OVERFLOW(p, (sizeof_size * sdim->rank), p_end))
+ /* Sizes */
+
+ /* Check that we have space to decode sdim->rank values */
+ if (H5_IS_BUFFER_OVERFLOW(p, (H5F_sizeof_size(f) * sdim->rank), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
if (NULL == (sdim->size = (hsize_t *)H5FL_ARR_MALLOC(hsize_t, (size_t)sdim->rank)))
HGOTO_ERROR(H5E_RESOURCE, H5E_CANTALLOC, NULL, "memory allocation failed")
-
for (i = 0; i < sdim->rank; i++)
H5F_DECODE_LENGTH(f, p, sdim->size[i]);
+ /* Max sizes */
+
if (flags & H5S_VALID_MAX) {
if (NULL == (sdim->max = (hsize_t *)H5FL_ARR_MALLOC(hsize_t, (size_t)sdim->rank)))
HGOTO_ERROR(H5E_RESOURCE, H5E_CANTALLOC, NULL, "memory allocation failed")
- /*
- * Ensure that decoding doesn't cause reading past buffer's end,
- * due to possible data corruption - check that we have space to
- * decode a "sdim->rank" number of hsize_t values
- */
- if (H5_IS_BUFFER_OVERFLOW(p, (sizeof_size * sdim->rank), p_end))
+ /* Check that we have space to decode sdim->rank values */
+ if (H5_IS_BUFFER_OVERFLOW(p, (H5F_sizeof_size(f) * sdim->rank), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding")
-
for (i = 0; i < sdim->rank; i++)
H5F_DECODE_LENGTH(f, p, sdim->max[i]);
- } /* end if */
- } /* end if */
+ }
+
+ /* NOTE: The version 1 permutation indexes were never implemented so
+ * there is nothing to decode.
+ */
+ }
/* Compute the number of elements in the extent */
if (sdim->type == H5S_NULL)
@@ -217,16 +213,16 @@ H5O__sdspace_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UN
else {
for (i = 0, sdim->nelem = 1; i < sdim->rank; i++)
sdim->nelem *= sdim->size[i];
- } /* end else */
+ }
/* Set return value */
- ret_value = (void *)sdim; /*success*/
+ ret_value = (void *)sdim;
done:
if (!ret_value && sdim) {
H5S__extent_release(sdim);
- sdim = H5FL_FREE(H5S_extent_t, sdim);
- } /* end if */
+ H5FL_FREE(H5S_extent_t, sdim);
+ }
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__sdspace_decode() */
diff --git a/src/H5Oshmesg.c b/src/H5Oshmesg.c
index 586e2ce..8510c6e 100644
--- a/src/H5Oshmesg.c
+++ b/src/H5Oshmesg.c
@@ -56,29 +56,25 @@ const H5O_msg_class_t H5O_MSG_SHMESG[1] = {{
}};
/*-------------------------------------------------------------------------
- * Function: H5O__shmesg_decode
+ * Function: H5O__shmesg_decode
*
- * Purpose: Decode a shared message table message and return a pointer
+ * Purpose: Decode a shared message table message and return a pointer
* to a newly allocated H5O_shmesg_table_t struct.
*
- * Return: Success: Ptr to new message in native struct.
- * Failure: NULL
- *
- * Programmer: James Laird
- * Jan 29, 2007
- *
+ * Return: Success: Ptr to new message in native struct.
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
H5O__shmesg_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
- unsigned H5_ATTR_UNUSED *ioflags, size_t H5_ATTR_UNUSED p_size, const uint8_t *p)
+ unsigned H5_ATTR_UNUSED *ioflags, size_t p_size, const uint8_t *p)
{
- H5O_shmesg_table_t *mesg; /* Native message */
- void *ret_value = NULL; /* Return value */
+ H5O_shmesg_table_t *mesg; /* New shared message table */
+ const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* Sanity check */
HDassert(f);
HDassert(p);
@@ -87,14 +83,25 @@ H5O__shmesg_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
"memory allocation failed for shared message table message")
/* Retrieve version, table address, and number of indexes */
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
mesg->version = *p++;
+
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_addr_decode(f, &p, &(mesg->addr));
+
+ if (H5_IS_BUFFER_OVERFLOW(p, 1, p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
mesg->nindexes = *p++;
/* Set return value */
ret_value = (void *)mesg;
done:
+ if (!ret_value && mesg)
+ H5MM_xfree(mesg);
+
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__shmesg_decode() */
diff --git a/src/H5Ostab.c b/src/H5Ostab.c
index ae4635e..2428f06 100644
--- a/src/H5Ostab.c
+++ b/src/H5Ostab.c
@@ -13,10 +13,8 @@
/*-------------------------------------------------------------------------
*
* Created: H5Ostab.c
- * Aug 6 1997
- * Robb Matzke
*
- * Purpose: Symbol table messages.
+ * Purpose: Symbol table messages
*
*-------------------------------------------------------------------------
*/
@@ -78,41 +76,39 @@ H5FL_DEFINE_STATIC(H5O_stab_t);
* Purpose: Decode a symbol table message and return a pointer to
* a newly allocated one.
*
- * Return: Success: Ptr to new message in native order.
- *
- * Failure: NULL
- *
- * Programmer: Robb Matzke
- * Aug 6 1997
- *
+ * Return: Success: Pointer to new message in native order
+ * Failure: NULL
*-------------------------------------------------------------------------
*/
static void *
H5O__stab_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNUSED mesg_flags,
- unsigned H5_ATTR_UNUSED *ioflags, size_t H5_ATTR_UNUSED p_size, const uint8_t *p)
+ unsigned H5_ATTR_UNUSED *ioflags, size_t p_size, const uint8_t *p)
{
- H5O_stab_t *stab = NULL;
- void *ret_value = NULL; /* Return value */
+ H5O_stab_t *stab = NULL;
+ const uint8_t *p_end = p + p_size - 1; /* End of the p buffer */
+ void *ret_value = NULL;
FUNC_ENTER_PACKAGE
- /* check args */
HDassert(f);
HDassert(p);
- /* decode */
if (NULL == (stab = H5FL_CALLOC(H5O_stab_t)))
HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, NULL, "memory allocation failed")
+
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_addr_decode(f, &p, &(stab->btree_addr));
+
+ if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_addr(f), p_end))
+ HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_addr_decode(f, &p, &(stab->heap_addr));
- /* Set return value */
ret_value = stab;
done:
- if (ret_value == NULL)
- if (stab != NULL)
- stab = H5FL_FREE(H5O_stab_t, stab);
+ if (!ret_value && stab)
+ H5FL_FREE(H5O_stab_t, stab);
FUNC_LEAVE_NOAPI(ret_value)
} /* end H5O__stab_decode() */