Experimental Physics and
Industrial Control System

Andrew Johnson <[email protected]> · Tue, 09 Mar 2004 14:25:51 -0600

Hi Mark,

Ok, I found the problem - a bug in inet_addr(), which ftpXfer() calls

passing in the hostname string. This is the Tornado 2.2 version of the

code, which works:

		inet_addr:
4e56 fff0                LINK  .W    A6,#0xfff0
48e7 3838                MOVEM .L    D2-D4/A2-A4,-(A7)
226e 0008                MOVEA .L    (0x8,A6),A1
47ee fff0                LEA         (0xfff0,A6),A3
4a89                     TST   .L    A1
6700 0150                BEQ         error
4282                     CLR   .L    D2
760a                     MOVEQ       #10,D3
0c11 0030                CMPI  .B    '0',(A1)
6614                     BNE         not0
7608                     MOVEQ       #8,D3
5289                     ADDQ  .L    #1,A1

0c11 0078                CMPI  .B    'x',(A1)
6706                     BEQ         yesx
0c11 0058                CMPI  .B    'X',(A1)
6604                     BNE         not0
		yesx:
7610                     MOVEQ       #16,D3
5289                     ADDQ  .L    #1,A1
		not0:
1011                     MOVE  .B    (A1),D0

It compares the first character with '0' and if it's not that defaults to

base 10 and attempts to convert the string into a number. If it is '0'

then it might be an octal number, but it also looks at the next character

in case it's an 'x' or 'X' meaning base 16.

This is the Tornado 2.0.2 version, which is broken:

		inet_addr:
4e56 fff0                LINK  .W    A6,#0xfff0
48e7 3038                MOVEM .L    D2-D3/A2-A4,-(A7)
226e 0008                MOVEA .L    (0x8,A6),A1
49ee fff0                LEA         (0xfff0,A6),A4
4a89                     TST   .L    A1
6700 014a                BEQ         error
4281                     CLR   .L    D1
740a                     MOVEQ       #10,D2
0c11 0030                CMPI  .B    '0',(A1)
6604                     BNE         not0
7408                     MOVEQ       #8,D2
5249                     ADDQ  .W    #1,A1
		not0:
0c11 0078                CMPI  .B    'x',(A1)
6706                     BEQ         yesx
0c11 0058                CMPI  .B    'X',(A1)
6604                     BNE         notX
		yesx:
7410                     MOVEQ       #16,D2
5249                     ADDQ  .W    #1,A1
		notX:
1011                     MOVE  .B    (A1),D0

In this case, if the first character is not '0' it branches to the wrong

place and checks whether it's an 'x' or 'X'; thus one can give a hex inet

address as either 0x12345678 or just x12345678.

If you really wanted to fix this, you could take a hex editor and modify

the 0x6604 instruction which appears 0x1e bytes into the inet_addr

routine, replacing it with 0x6614 which fixes the branch to go to the

right place. However this is buried inside an object file which itself is

inside a library archive, and you probably don't want to go to all that

trouble.

A simpler solution would be not to use hostnames that start with an 'x',

or if you do just make sure that it includes a character which is not a

hex digit. Of course the IOC's idea of the boot host name doesn't have to

be the same as the rest of the world's either - you could tell the IOC

that it's booting from HOSTx17b3 and it'll be perfectly happy and

everything will work correctly.

- Andrew
--
Dear God, I didn't think orange went with purple until I saw
the sunset you made last night.  That was really cool. - Caro

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System