From 7add52ff4f2443357648d53d52add274d1b18b5f Mon Sep 17 00:00:00 2001
From: Binh-Minh Ribler <bmribler@hdfgroup.org>
Date: Wed, 20 Mar 2019 14:03:48 -0500
Subject: Fixed HDFFV-10210 and HDFFV-10587 Description:     - Added parameter
 validation (HDFFV-10210)     - Added detection of division by zero
 (HDFFV-10587 - CVE-2018-17438)     - Fixed typos in various tests Platforms
 tested:     Linux/64 (jelly)     Linux/64 (platypus)     Darwin (osx1011test)

---
 c++/test/tobject.cpp |  4 ++--
 src/H5Dselect.c      |  2 ++
 src/H5I.c            |  3 +++
 test/tid.c           | 15 +++++++++++++++
 test/titerate.c      |  2 +-
 5 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/c++/test/tobject.cpp b/c++/test/tobject.cpp
index 537716f..23c1453 100644
--- a/c++/test/tobject.cpp
+++ b/c++/test/tobject.cpp
@@ -609,10 +609,10 @@ static void test_getobjectinfo_same_file()
     catch (Exception& E)
     {
         cerr << " in Exception " << E.getCFuncName() << "detail: " << E.getCDetailMsg() << endl;
-        issue_fail_msg("test_file_name()", __LINE__, __FILE__, E.getCDetailMsg());
+        issue_fail_msg("test_getobjectinfo_same_file()", __LINE__, __FILE__, E.getCDetailMsg());
     }
 
-}   // test_h5o_getinfo_same_file
+}   // test_getobjectinfo_same_file
 
 /*-------------------------------------------------------------------------
  * Function:    test_object
diff --git a/src/H5Dselect.c b/src/H5Dselect.c
index 0ec3423..4ffce62 100644
--- a/src/H5Dselect.c
+++ b/src/H5Dselect.c
@@ -227,6 +227,8 @@ H5D__select_io(const H5D_io_info_t *io_info, size_t elmt_size,
 
             /* Decrement number of elements left to process */
             HDassert(((size_t)tmp_file_len % elmt_size) == 0);
+            if(elmt_size == 0)
+                HGOTO_ERROR(H5E_DATASPACE, H5E_BADVALUE, FAIL, "Resulted in division by zero")
             nelmts -= ((size_t)tmp_file_len / elmt_size);
         } /* end while */
     } /* end else */
diff --git a/src/H5I.c b/src/H5I.c
index ca9ff61..345c010 100644
--- a/src/H5I.c
+++ b/src/H5I.c
@@ -355,6 +355,9 @@ H5Itype_exists(H5I_type_t type)
     FUNC_ENTER_API(FAIL)
     H5TRACE1("t", "It", type);
 
+    if(H5I_IS_LIB_TYPE(type))
+        HGOTO_ERROR(H5E_ATOM, H5E_BADGROUP, FAIL, "cannot call public function on library type")
+
     if (type <= H5I_BADID || type >= H5I_next_type)
         HGOTO_ERROR(H5E_ARGS, H5E_BADRANGE, FAIL, "invalid type number")
 
diff --git a/test/tid.c b/test/tid.c
index 8a27c3b..d2bcdc4 100644
--- a/test/tid.c
+++ b/test/tid.c
@@ -224,6 +224,21 @@ static int basic_id_test(void)
             goto out;
     H5E_END_TRY
 
+    /* Test that H5Itype_exists cannot be called on library types because
+     * it is a public function
+     */
+    H5E_BEGIN_TRY
+        err = H5Itype_exists(H5I_GROUP);
+        if(err >= 0)
+            goto out;
+    H5E_END_TRY
+
+    H5E_BEGIN_TRY
+        err = H5Itype_exists(H5I_ATTR);
+        if(err >= 0)
+            goto out;
+    H5E_END_TRY
+
     return 0;
 
 out:
diff --git a/test/titerate.c b/test/titerate.c
index 87ddfb8..5fad1b4 100644
--- a/test/titerate.c
+++ b/test/titerate.c
@@ -946,7 +946,7 @@ find_err_msg_cb(unsigned n, const H5E_error2_t *err_desc, void *_client_data)
 
     if (searched_err == NULL)
         return -1;
-    
+
     /* If the searched error message is found, stop the iteration */
     if (err_desc->desc != NULL && strcmp(err_desc->desc, searched_err->message) == 0)
     {
-- 
cgit v0.12


From fe104cc38ffbdb39d3e04da107d86ebfc7e8b622 Mon Sep 17 00:00:00 2001
From: Binh-Minh Ribler <bmribler@hdfgroup.org>
Date: Thu, 21 Mar 2019 11:09:17 -0500
Subject: Test improvement Description     Moved the new tests to a more
 appropriate test function. Platforms tested:     Linux/64 (jelly)

---
 test/tid.c | 43 +++++++++++++++++++++++++------------------
 1 file changed, 25 insertions(+), 18 deletions(-)

diff --git a/test/tid.c b/test/tid.c
index d2bcdc4..7f61c6a 100644
--- a/test/tid.c
+++ b/test/tid.c
@@ -224,21 +224,6 @@ static int basic_id_test(void)
             goto out;
     H5E_END_TRY
 
-    /* Test that H5Itype_exists cannot be called on library types because
-     * it is a public function
-     */
-    H5E_BEGIN_TRY
-        err = H5Itype_exists(H5I_GROUP);
-        if(err >= 0)
-            goto out;
-    H5E_END_TRY
-
-    H5E_BEGIN_TRY
-        err = H5Itype_exists(H5I_ATTR);
-        if(err >= 0)
-            goto out;
-    H5E_END_TRY
-
     return 0;
 
 out:
@@ -266,7 +251,10 @@ static int id_predefined_test(void )
 
     testObj = HDmalloc(sizeof(int));
 
-    /* Try to perform illegal functions on various predefined types */
+    /*
+     * Attempt to perform public functions on various library types
+     */
+
     H5E_BEGIN_TRY
         testID = H5Iregister(H5I_FILE, testObj);
     H5E_END_TRY
@@ -307,7 +295,26 @@ static int id_predefined_test(void )
     if(testErr >= 0)
         goto out;
 
-    /* Create a datatype ID and try to perform illegal functions on it */
+    H5E_BEGIN_TRY
+        testErr = H5Itype_exists(H5I_GROUP);
+    H5E_END_TRY
+
+    VERIFY(testErr, -1, "H5Itype_exists");
+    if(testErr != -1)
+        goto out;
+
+    H5E_BEGIN_TRY
+        testErr = H5Itype_exists(H5I_ATTR);
+    H5E_END_TRY
+
+    VERIFY(testErr, -1, "H5Itype_exists");
+    if(testErr != -1)
+        goto out;
+
+    /*
+     * Create a datatype ID and try to perform illegal functions on it
+     */
+
     typeID = H5Tcreate(H5T_OPAQUE, (size_t)42);
     CHECK(typeID, H5I_INVALID_HID, "H5Tcreate");
     if(typeID == H5I_INVALID_HID)
@@ -332,7 +339,7 @@ static int id_predefined_test(void )
     H5Tclose(typeID);
 
     /* testObj was never registered as an atom, so it will not be
-         * automatically freed. */
+     * automatically freed. */
     HDfree(testObj);
     return 0;
 
-- 
cgit v0.12