Experimental Physics and
Industrial Control System

"J. Lewis Muir" <[email protected]> · Tue, 09 Oct 2007 10:01:58 -0400

On 10/9/07 8:29 AM, Dirk Zimoch wrote:

Hi Ben,
Just coming back from vacation I found this:
Benjamin Franksen wrote:
[...]

Ok, I've found one bug in stream version 2-2 that leads to a crash. A
format of "%*[whatever>]"

gets converted internally to "%0[whatever>]%n" and then only /one/
pointer arg is provided to sscanf, instead of two. The method where
sscanf crashes is in StreamFormatConverter.cc:

This bug had been reported to me by Emma Shepherd on August 27. A patch
to fix this bug is available on the StreamDevice web page since the same
day.
If you find bugs, I can only fix them if you report them!
Watch the web page for patches.
Thanks,
Dirk

Hi, Dirk.
Just a suggestion, why not make a new release, say version 2.2.1,
instead of making a patch available? This would have likely prevented
Benjamin's confusion. Also, it's easy to download the latest version,
it's more work to download each patch and figure out how they should be
applied.
If you do stick with the release + patches approach, I think that making
the patches available right next to the release like you do is a good
idea. Some projects have a Known Problems link one has to click on in
order to even find patches; this tends to lead to more than one person
reporting the same bug or running into the same problem because they
didn't know there was a patch for it already.
-lewis

int StdCharsetConverter::
scanString(const StreamFormat& fmt, const char* input,
    char* value, size_t maxlen)
{
    int length = -1;
    if (fmt.flags & skip_flag)
    {
        if (sscanf (input, fmt.info, &length) < 0) return -1;
    }
    ....
Since skip_flag is set only for %* formats, it is wrong to replace it
with %0. Thus the parse method must be changed, like this (see comments):
int StdCharsetConverter::

parse(const StreamFormat& fmt, StreamBuffer& info,

const char*& source, bool scanFormat)

{

if (!scanFormat)

{

error("Format conversion %%[ is only allowed in input
formats\n");

return false;

}

if (fmt.flags & (left_flag|sign_flag|space_flag|zero_flag|alt_flag))

{

error("Use of modifiers '-', '+', ' ', '0', '#'"

"not allowed with %%%c conversion\n",

fmt.conv);

return false;

}

if (scanFormat && fmt.prec >= 0)

{

error("Use of precision field '.%d' not allowed with %%%c
input conversion\n",

fmt.prec, fmt.conv);

return false;

}

// fix: bfr 20/09/07

if (fmt.flags & skip_flag ) {

info.printf("%%*[");

}

else {

info.printf("%%%d[", fmt.width);

}

// end fix

while (*source && *source != ']')

{

if (*source == esc) source++;

info.append(*source++);

}

if (!*source) {

error("Missing ']' after %%[ format conversion\n");

return false;

}

source++; // consume ']'

info.append("]%n");

return string_format;

}
However, the IOC crashes anyway, because this is just one of many
bugs. I'll send more debugger output soon.
Cheers
Ben

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System