Experimental Physics and
Industrial Control System

Andy Foster <[email protected]> · Mon, 29 Oct 2001 18:14:24 +0000 (GMT)

Recently, while trying some examples with et_wish
at Daresbury Lab, it was noticed that it is possible
to cause a crash by monitoring the VAL field
of an "mbbi" record which is using "Raw Soft Channel"
device support.

The crash occurs if RVAL is set to a value which does
not correspond to a valid state.

Looking at "tclCa.c", the relevant code appears to be at
line 983:

  case DBF_ENUM:
    if (strlen(pch->info.e.strs[pch->pdata->e.value]) != 0) {
      Tcl_SetVar(pch->interp, pch->pitem->tclname,
                 pch->info.e.strs[pch->pdata->e.value],
                 TCL_GLOBAL_ONLY);
    } else {
      sprintf(buf, "%d", pch->pdata->e.value);
      Tcl_SetVar(pch->interp, pch->pitem->tclname, buf,
                 TCL_GLOBAL_ONLY);
    }
    break;

The crash is caused by the "pch->info.e.strs[pch->pdata->e.value]"
because the index into the strs is out of range.
One solution would be to replace this with:

    if( pch->pdata->e.value <= pch->info.e.no_str )
    {
      Tcl_SetVar(pch->interp, pch->pitem->tclname,
                 pch->info.e.strs[pch->pdata->e.value],
                 TCL_GLOBAL_ONLY);
    }
    else
    {
      sprintf(buf, "%d", pch->pdata->e.value);
      Tcl_SetVar(pch->interp, pch->pitem->tclname, buf,
                 TCL_GLOBAL_ONLY);
    }
    break;

So that we only use a valid index into the array of state strings
otherwise we just report the value as given.

Cheers,

Andy

--------------------------------------------------------------------
Observatory Sciences Limited    Email: [email protected]
William James House             Tel: 44 - (0)1223 - 508259
Cowley Road                     Fax: 44 - (0)1223 - 508258
Cambridge, CB4 0WX, UK          http://www.observatorysciences.co.uk

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System