Experimental Physics and
Industrial Control System

Jens Eden <[email protected]> · Wed, 07 Feb 2001 12:32:34 +0100

Hi all,

the VMS-Compiler complained about an array overflow in gdd/dbMapper.cc (EPICS
R3.13.3).

line 1094: (function: mapGraphicGddToEnum() )
	strncpy(&(db->strs[i][0]),str[i].fixed_string, 
		sizeof(aitFixedString));
	db->strs[i][sizeof(aitFixedString)-1u] = '\0';

db is of type dbr_gr_enum with db->strs[MAX_ENUM_STATES][MAX_ENUM_STRING_SIZE]
with MAX_ENUM_STATES = 16 and MAX_ENUM_STRING_SIZE = 26

aitFixedString is a char array of size AIT_FIXED_STRING_SIZE, which is defined
to be 40.
So strncpy may copy up to 40 characters into a char-array with length 26, which
could corrupt memory (especially if the enum array is filled up with 16
entries). 

Same problem at line: 1117 (function: mapControlGddToEnum() )

Better is the following:

	strncpy(...,...,MAX_ENUM_STRING_SIZE);
	db->strs[i][MAX_ENUM_STRING_SIZE-1u] = '\0';

Jens

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System