rset::get_enum_str() API problem
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
EPICS Base |
Triaged
|
Medium
|
Unassigned |
Bug Description
The recSup.h typed_rset get_enum_str() method has this prototype:
long (*get_enum_
The method gets no indication how large pbuffer is, so it's easy for it to overflow it, although not by much.
The bi and bo records both hope it's one byte longer than their associated ZNAM/ONAM fields (which are 26 bytes long) because they call strncpy(
The mbbi and mbbo records at least don't overflow the buffer they assume is 26 bytes long since they don't bother writing the nil byte after calling strncpy(
No other record types in Base define this method, which isn't trivial to get called. I think this database should be doing it when lsi gets processed, although valgrind doesn't seem to notice the overflow:
record(bi, bi) {
field(ZNAM, "26-character-
}
record(lsi, "lsi") {
field(SIZV, 16) # This is the minimum that lsi actually uses.
field(INP, "bi")
}