db: validate dbrType

modules/database/src/ioc/db/dbAccess.c

@@ -736,6 +736,8 @@ long dbValueSize(short dbr_type)
         sizeof(epicsFloat64),        /* DOUBLE       */
         sizeof(epicsEnum16)};        /* ENUM         */
 
+    if(dbr_type>=NELEMENTS(size))
+        return 0;
     return(size[dbr_type]);
 }
 

modules/database/src/ioc/db/dbCa.c

@@ -52,6 +52,9 @@
 #include "recGbl.h"
 #include "recSup.h"
 
+/* from dbAccessDefs.h which can't be included here */
+#define S_db_badDbrtype (M_dbAccess| 3)
+
 /* defined in dbContext.cpp
  * Setup local CA access
  */
@@ -457,6 +460,9 @@ long dbCaPutLinkCallback(struct link *plink,short dbrType,
     long   status = 0;
     short  link_action = 0;
 
+    if(INVALID_DB_REQ(dbrType))
+        return S_db_badDbrtype;
+
     assert(pca);
     /* put the new value in */
     epicsMutexMustLock(pca->lock);

modules/database/src/ioc/db/dbConvertJSON.c

@@ -159,6 +159,9 @@ long dbPutConvertJSON(const char *json, short dbrType,
     size_t jlen = strlen(json);
     long status;
 
+    if(INVALID_DB_REQ(dbrType))
+        return S_db_badDbrtype;
+
     parser->depth = 0;
     parser->dbrType = dbrType;
     parser->dbrSize = dbValueSize(dbrType);

modules/database/src/std/link/lnkCalc.c

@@ -553,7 +553,12 @@ static long lnkCalc_getValue(struct link *plink, short dbrType, void *pbuffer,
     dbCommon *prec = plink->precord;
     int i;
     long status;
-    FASTCONVERT conv = dbFastPutConvertRoutine[DBR_DOUBLE][dbrType];
+    FASTCONVERT conv;
+
+    if(INVALID_DB_REQ(dbrType))
+        return S_db_badDbrtype;
+
+    conv = dbFastPutConvertRoutine[DBR_DOUBLE][dbrType];
 
     /* Any link errors will trigger a LINK/INVALID alarm in the child link */
     for (i = 0; i < clink->nArgs; i++) {
@@ -624,7 +629,12 @@ static long lnkCalc_putValue(struct link *plink, short dbrType,
     dbCommon *prec = plink->precord;
     int i;
     long status;
-    FASTCONVERT conv = dbFastGetConvertRoutine[dbrType][DBR_DOUBLE];
+    FASTCONVERT conv;
+
+    if(INVALID_DB_REQ(dbrType))
+        return S_db_badDbrtype;
+
+    conv = dbFastGetConvertRoutine[dbrType][DBR_DOUBLE];
 
     /* Any link errors will trigger a LINK/INVALID alarm in the child link */
     for (i = 0; i < clink->nArgs; i++) {

modules/database/src/std/link/lnkConst.c

@@ -361,6 +361,9 @@ static long lnkConst_loadScalar(struct link *plink, short dbrType, void *pbuffer
     const_link *clink = CONTAINER(plink->value.json.jlink, const_link, jlink);
     long status;
 
+    if(INVALID_DB_REQ(dbrType))
+        return S_db_badDbrtype;
+
     switch (clink->type) {
     case si64:
         if (clink->jlink.debug)
@@ -451,12 +454,17 @@ static long lnkConst_loadArray(struct link *plink, short dbrType, void *pbuffer,
         long *pnReq)
 {
     const_link *clink = CONTAINER(plink->value.json.jlink, const_link, jlink);
-    short dbrSize = dbValueSize(dbrType);
+    short dbrSize;
     char *pdest = pbuffer;
     int nElems = clink->nElems;
     FASTCONVERT conv;
     long status;
 
+    if(INVALID_DB_REQ(dbrType))
+        return S_db_badDbrtype;
+
+    dbrSize = dbValueSize(dbrType);
+
     if (nElems > *pnReq)
         nElems = *pnReq;
 

modules/database/src/std/link/lnkState.c

@@ -142,7 +142,12 @@ static long lnkState_getValue(struct link *plink, short dbrType, void *pbuffer,
 {
     state_link *slink = CONTAINER(plink->value.json.jlink,
         struct state_link, jlink);
-    FASTCONVERT conv = dbFastPutConvertRoutine[DBR_SHORT][dbrType];
+    FASTCONVERT conv;
+
+    if(INVALID_DB_REQ(dbrType))
+        return S_db_badDbrtype;
+
+    conv = dbFastPutConvertRoutine[DBR_SHORT][dbrType];
 
     slink->val = slink->invert ^ dbStateGet(slink->state);
     return conv(&slink->val, pbuffer, NULL);