From 6e9b7ced76c921a0d82d1712d58bc5505f8fd811 Mon Sep 17 00:00:00 2001
From: Binh-Minh Ribler <bmribler@hdfgroup.org>
Date: Sun, 24 Mar 2019 14:36:32 -0500
Subject: Fixed HDFFV-10210 and HDFFV-10587 Description:     - Added parameter
 validation (HDFFV-10210)     - Added detection of division by zero
 (HDFFV-10587 - CVE-2018-17438)     - Fixed typos in various tests Platforms
 tested:     Linux/64 (jelly)     Linux/64 (platypus)     Darwin (osx1011test)

---
 src/H5Dselect.c |  2 ++
 src/H5I.c       |  3 +++
 test/tid.c      | 26 +++++++++++++++++++++++---
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/src/H5Dselect.c b/src/H5Dselect.c
index 7e86b9d..7c02c05 100644
--- a/src/H5Dselect.c
+++ b/src/H5Dselect.c
@@ -220,6 +220,8 @@ H5D__select_io(const H5D_io_info_t *io_info, size_t elmt_size,
 
             /* Decrement number of elements left to process */
             HDassert(((size_t)tmp_file_len % elmt_size) == 0);
+            if(elmt_size == 0)
+                HGOTO_ERROR(H5E_DATASPACE, H5E_BADVALUE, FAIL, "Resulted in division by zero")
             nelmts -= ((size_t)tmp_file_len / elmt_size);
         } /* end while */
     } /* end else */
diff --git a/src/H5I.c b/src/H5I.c
index 2a4a38c2..7783985 100644
--- a/src/H5I.c
+++ b/src/H5I.c
@@ -406,6 +406,9 @@ H5Itype_exists(H5I_type_t type)
     FUNC_ENTER_API(FAIL)
     H5TRACE1("t", "It", type);
 
+    if(H5I_IS_LIB_TYPE(type))
+        HGOTO_ERROR(H5E_ATOM, H5E_BADGROUP, FAIL, "cannot call public function on library type")
+
     if(type <= H5I_BADID || type >= H5I_next_type)
 	HGOTO_ERROR(H5E_ARGS, H5E_BADRANGE, FAIL, "invalid type number")
 
diff --git a/test/tid.c b/test/tid.c
index c98514b..6375d77 100644
--- a/test/tid.c
+++ b/test/tid.c
@@ -250,7 +250,9 @@ static int id_predefined_test(void )
 
 	testObj = HDmalloc(sizeof(int));
 
-	/* Try to perform illegal functions on various predefined types */
+    /*
+     * Attempt to perform public functions on various library types
+     */
 	H5E_BEGIN_TRY
 		testID = H5Iregister(H5I_FILE, testObj);
 	H5E_END_TRY
@@ -291,7 +293,25 @@ static int id_predefined_test(void )
 	if(testErr >= 0)
 		goto out;
 
-	/* Create a datatype ID and try to perform illegal functions on it */
+    H5E_BEGIN_TRY
+        testErr = H5Itype_exists(H5I_GROUP);
+    H5E_END_TRY
+
+    VERIFY(testErr, FAIL, "H5Itype_exists");
+    if(testErr != FAIL)
+        goto out;
+
+    H5E_BEGIN_TRY
+        testErr = H5Itype_exists(H5I_ATTR);
+    H5E_END_TRY
+
+    VERIFY(testErr, FAIL, "H5Itype_exists");
+    if(testErr != FAIL)
+        goto out;
+
+    /*
+     * Create a datatype ID and try to perform illegal functions on it
+     */
 	typeID = H5Tcreate(H5T_OPAQUE, (size_t)42);
 	CHECK(typeID, H5I_INVALID_HID, "H5Tcreate");
 	if(typeID == H5I_INVALID_HID)
@@ -316,7 +336,7 @@ static int id_predefined_test(void )
 	H5Tclose(typeID);
 
 	/* testObj was never registered as an atom, so it will not be
-         * automatically freed. */
+     * automatically freed. */
 	HDfree(testObj);
 	return 0;
 
-- 
cgit v0.12