From 7632c355eee6dc72dfecec2295f93e853a9524ad Mon Sep 17 00:00:00 2001 From: Andrew Johnson Date: Tue, 26 Jun 2018 18:14:26 -0500 Subject: [PATCH] dbpr: Catch buffer overflow from long link strings. Fixes lp: #1776141 Currently this just truncates when we hit the end of the buffer, a better solution is warranted. --- src/ioc/db/dbTest.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/ioc/db/dbTest.c b/src/ioc/db/dbTest.c index 7f4f77b95..f63e67108 100644 --- a/src/ioc/db/dbTest.c +++ b/src/ioc/db/dbTest.c @@ -41,12 +41,13 @@ #include "special.h" #define MAXLINE 80 +#define MAXMESS 128 struct msgBuff { /* line output structure */ char out_buff[MAXLINE + 1]; char *pNext; char *pLast; char *pNexTab; - char message[128]; + char message[MAXMESS]; }; typedef struct msgBuff TAB_BUFFER; @@ -1205,7 +1206,7 @@ static int dbpr_report( sprintf(pmsg,"%s: Illegal Link Type", pfield_name); } else { - sprintf(pmsg,"%s:%s %s", pfield_name, + epicsSnprintf(pmsg, MAXMESS, "%s:%s %s", pfield_name, pamaplinkType[ind].strvalue,dbGetString(pdbentry)); } dbpr_msgOut(pMsgBuff, tab_size);