mirror of
https://github.com/HDFGroup/hdf5.git
synced 2026-09-25 04:09:44 +03:00
Scot Breitenfeld
a3892b08aa
* Fix memory safety vulnerabilities in high-level and VFD code H5FDstdio (src/H5FDstdio.c): - Fix five error paths in H5FD_stdio_open() that called fclose(f) after free(file): the correct resource to close is file->fp. Reorder to fclose before free to match standard cleanup idiom and prevent file descriptor leaks under memory-pressure failures. H5VLnative (src/H5VLnative.c): - Add assert(obj) and assert(file) to H5VL_native_get_file_struct() to catch NULL-pointer programming errors early in debug builds. H5LT (hl/src/H5LT.c): - Add NULL check after strdup() in H5LTtext_to_dtype(); push H5E_NOSPACE so the HDF5 error stack is populated on OOM. - Fix H5Tclose(super) leak in H5T_ENUM, H5T_VLEN, H5T_ARRAY, H5T_COMPLEX branches of H5LT_dtype_to_text(): super was only closed on the success path; any failure between H5Tget_super and the final realloc_and_append leaked the type ID. Super is now closed immediately after use. - Refactor the repeated "get super-type text and append" pattern (four near-identical ~15-line blocks) into static helper append_dtype_super_text(). Pushes H5E_NOSPACE on internal calloc failure. - Rewrite realloc_and_append() doc comment to document the asymmetric ownership contract (callee frees buf on realloc failure in library-managed mode; no free in user-buf mode). - Move the buf == NULL guard to before the _no_user_buf branch so both modes short-circuit identically. H5TB (hl/src/H5TB.c): - Clarify H5TBget_field_info() else-branch comment: the two-branch copy structure is an efficiency optimization (copy name_len+1 bytes rather than HLTB_MAX_FIELD_LEN-1), not a backward-compatibility concern. CHANGELOG (release_docs/CHANGELOG.md): - Add entries for the stdio VFD leak fix, VOL NULL checks, and H5LT memory-safety improvements. * HL: add realloc_and_append invariant comments per fortnern review Document the failure-path contract for realloc_and_append: buf is passed by value so the caller's pointer is never written by the function; failure is signaled solely through a NULL return; in library-managed mode the underlying memory is freed on failure so callers must not access the original pointer afterward. Also annotate the point after a successful realloc where the function can no longer fail. * HL: reposition 'cannot fail' comment before buf assignment The comment should mark the transition out of the failure zone — after the only exit path (goto out), before buf = tmp_realloc. Also drop the redundant else since the if body always exits. * HL: fix nested comment syntax error in realloc_and_append Note