From 4de770788fd2e0d751944d7a8378778f64a72083 Mon Sep 17 00:00:00 2001
From: Vailin Choi <vchoi@hdfgroup.org>
Date: Fri, 20 Mar 2015 17:37:17 -0500
Subject: [svn-r26514] Fix for HDFFV-9173: H5Pset_istore_k() will validate the
 "ik" value to not exceed the max v1 btree entries (2 bytes) The same check
 for H5Pset_sym_k()  "ik" value. h5committested.

---
 src/H5Fprivate.h |  2 ++
 src/H5Pfcpl.c    |  6 ++++++
 test/tmisc.c     | 12 ++++++++++++
 3 files changed, 20 insertions(+)

diff --git a/src/H5Fprivate.h b/src/H5Fprivate.h
index fe81edc..4cd8c69 100644
--- a/src/H5Fprivate.h
+++ b/src/H5Fprivate.h
@@ -488,6 +488,8 @@
                                                     if it is changed, the code
                                                     must compensate. -QAK
                                                  */
+#define HDF5_BTREE_IK_MAX_ENTRIES       65536 	/* 2^16 - 2 bytes for storing entries (children) */
+						/* See format specification on version 1 B-trees */
 
 /* Default file space handling strategy */
 #define H5F_FILE_SPACE_STRATEGY_DEF	        H5F_FILE_SPACE_ALL
diff --git a/src/H5Pfcpl.c b/src/H5Pfcpl.c
index aca589c..5fc93fd 100644
--- a/src/H5Pfcpl.c
+++ b/src/H5Pfcpl.c
@@ -517,6 +517,9 @@ H5Pset_sym_k(hid_t plist_id, unsigned ik, unsigned lk)
 
     /* Set values */
     if (ik > 0) {
+	if((ik * 2) >= HDF5_BTREE_IK_MAX_ENTRIES)
+	    HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, FAIL, "istore IK value exceeds maximum B-tree entries");
+
         if(H5P_get(plist, H5F_CRT_BTREE_RANK_NAME, btree_k) < 0)
             HGOTO_ERROR(H5E_PLIST, H5E_CANTGET, FAIL, "can't get rank for btree interanl nodes");
         btree_k[H5B_SNODE_ID] = ik;
@@ -614,6 +617,9 @@ H5Pset_istore_k(hid_t plist_id, unsigned ik)
     if (ik == 0)
         HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, FAIL, "istore IK value must be positive");
 
+    if((ik * 2) >= HDF5_BTREE_IK_MAX_ENTRIES)
+        HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, FAIL, "istore IK value exceeds maximum B-tree entries");
+
     /* Get the plist structure */
     if(NULL == (plist = H5P_object_verify(plist_id,H5P_FILE_CREATE)))
         HGOTO_ERROR(H5E_ATOM, H5E_BADATOM, FAIL, "can't find object for ID");
diff --git a/test/tmisc.c b/test/tmisc.c
index 68a30eb..869557c 100644
--- a/test/tmisc.c
+++ b/test/tmisc.c
@@ -1847,9 +1847,21 @@ test_misc11(void)
     ret = H5Pset_sizes(fcpl, (size_t)MISC11_SIZEOF_OFF, (size_t)MISC11_SIZEOF_LEN);
     CHECK(ret, FAIL, "H5Pset_sizes");
 
+    /* This should fail as (32770*2) will exceed ^16 - 2 bytes for storing btree entries */
+    H5E_BEGIN_TRY {
+	ret=H5Pset_sym_k(fcpl, 32770, 0);
+    } H5E_END_TRY;
+    VERIFY(ret, FAIL, "H5Pset_sym_k");
+
     ret=H5Pset_sym_k(fcpl,MISC11_SYM_IK,MISC11_SYM_LK);
     CHECK(ret, FAIL, "H5Pset_sym_k");
 
+    /* This should fail as (32770*2) will exceed ^16 - 2 bytes for storing btree entries */
+    H5E_BEGIN_TRY {
+	ret=H5Pset_istore_k(fcpl, 32770);
+    } H5E_END_TRY;
+    VERIFY(ret, FAIL, "H5Pset_istore_k");
+
     ret=H5Pset_istore_k(fcpl,MISC11_ISTORE_IK);
     CHECK(ret, FAIL, "H5Pset_istore_k");
 
-- 
cgit v0.12