Experimental Physics and
Industrial Control System

Dirk Zimoch <[email protected]> · Tue, 09 Oct 2007 14:29:37 +0200

Hi Ben,
Just coming back from vacation I found this:
Benjamin Franksen wrote:
[...]

Ok, I've found one bug in stream version 2-2 that leads to a crash. A format
of "%*[whatever>]"

gets converted internally to "%0[whatever>]%n" and then only /one/ pointer
arg is provided to sscanf, instead of two. The method where sscanf crashes
is in StreamFormatConverter.cc:

This bug had been reported to me by Emma Shepherd on August 27. A patch to fix
this bug is available on the StreamDevice web page since the same day.
If you find bugs, I can only fix them if you report them!
Watch the web page for patches.
Thanks,
Dirk

int StdCharsetConverter::
scanString(const StreamFormat& fmt, const char* input,
    char* value, size_t maxlen)
{
    int length = -1;
    if (fmt.flags & skip_flag)
    {
        if (sscanf (input, fmt.info, &length) < 0) return -1;
    }
    ....
Since skip_flag is set only for %* formats, it is wrong to replace it with
%0. Thus the parse method must be changed, like this (see comments):
int StdCharsetConverter::

parse(const StreamFormat& fmt, StreamBuffer& info,

const char*& source, bool scanFormat)

{

if (!scanFormat)

{

error("Format conversion %%[ is only allowed in input formats\n");

return false;

}

if (fmt.flags & (left_flag|sign_flag|space_flag|zero_flag|alt_flag))

{

error("Use of modifiers '-', '+', ' ', '0', '#'"

"not allowed with %%%c conversion\n",

fmt.conv);

return false;

}

if (scanFormat && fmt.prec >= 0)

{

error("Use of precision field '.%d' not allowed with %%%c input
conversion\n",

fmt.prec, fmt.conv);

return false;

}

// fix: bfr 20/09/07

if (fmt.flags & skip_flag ) {

info.printf("%%*[");

}

else {

info.printf("%%%d[", fmt.width);

}

// end fix

while (*source && *source != ']')

{

if (*source == esc) source++;

info.append(*source++);

}

if (!*source) {

error("Missing ']' after %%[ format conversion\n");

return false;

}

source++; // consume ']'

info.append("]%n");

return string_format;

}
However, the IOC crashes anyway, because this is just one of many bugs. I'll
send more debugger output soon.
Cheers
Ben

--
Dr. Dirk Zimoch
Paul Scherrer Institut, WBGB/006
5232 Villigen PSI, Switzerland
Phone +41 56 310 5182

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System