From be6b69098bd01ae0d3e897d5ffbec9ad527472f5 Mon Sep 17 00:00:00 2001
From: Michael Davidsaver <mdavidsaver@gmail.com>
Date: Wed, 24 Jun 2026 15:19:19 -0700
Subject: [PATCH] rsrv: prevent use of CID between clients

In this context "CID" means Channel ID,
in this case meaning the server assigned identifier.
While in other contexts this is called SID (Server ID),
to distinguish from the Client ID (also CID :( )
---
 modules/database/src/ioc/rsrv/camessage.c | 32 ++++++++++++++---------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/modules/database/src/ioc/rsrv/camessage.c b/modules/database/src/ioc/rsrv/camessage.c
index f072e0920..1d8a37872 100644
--- a/modules/database/src/ioc/rsrv/camessage.c
+++ b/modules/database/src/ioc/rsrv/camessage.c
@@ -119,13 +119,21 @@ static void *casCalloc(size_t count, size_t size)
  *
  * used to be a macro
  */
-static struct channel_in_use *MPTOPCIU (const caHdrLargeArray *mp)
+static struct channel_in_use *MPTOPCIU (const caHdrLargeArray *mp,
+                                       struct client *client)
 {
     struct channel_in_use   *pciu;
     const unsigned      id = mp->m_cid;
 
     LOCK_CLIENTQ;
     pciu = bucketLookupItemUnsignedId (pCaBucket, &id);
+
+    if (pciu && pciu->client != client) {
+        /* reject attempt to use server assigned ID from another client
+         */
+        pciu = NULL;
+    }
+
     UNLOCK_CLIENTQ;
 
     return pciu;
@@ -161,7 +169,7 @@ va_list                 args
     case CA_PROTO_READ_NOTIFY:
     case CA_PROTO_WRITE:
     case CA_PROTO_WRITE_NOTIFY:
-        pciu = MPTOPCIU(curp);
+        pciu = MPTOPCIU(curp, client);
         if(pciu){
             cid = pciu->cid;
         }
@@ -315,7 +323,7 @@ static void log_header (
 
     ipAddrToDottedIP (&client->addr, hostName, sizeof(hostName));
 
-    pciu = MPTOPCIU(mp);
+    pciu = MPTOPCIU(mp, client);
 
     if (pContext) {
         epicsPrintf ("CAS: request from %s => %s\n",
@@ -647,7 +655,7 @@ static void read_reply ( void *pArg, struct dbChannel *dbch,
  */
 static int read_action ( caHdrLargeArray *mp, void *pPayloadIn, struct client *pClient )
 {
-    struct channel_in_use *pciu = MPTOPCIU ( mp );
+    struct channel_in_use *pciu = MPTOPCIU ( mp, pClient );
     int readAccess;
     ca_uint32_t payloadSize;
     void *pPayload;
@@ -745,7 +753,7 @@ static int read_notify_action ( caHdrLargeArray *mp, void *pPayload, struct clie
         return RSRV_ERROR;
     }
 
-    pciu = MPTOPCIU ( mp );
+    pciu = MPTOPCIU ( mp, client );
     if ( !pciu ) {
         logBadId ( client, mp, pPayload );
         return RSRV_ERROR;
@@ -781,7 +789,7 @@ static int write_action ( caHdrLargeArray *mp,
     long                    dbStatus;
     void                    *asWritePvt;
 
-    pciu = MPTOPCIU(mp);
+    pciu = MPTOPCIU(mp, client);
     if(!pciu){
         logBadId(client, mp, pPayload);
         return RSRV_ERROR;
@@ -1688,7 +1696,7 @@ static int write_notify_action ( caHdrLargeArray *mp, void *pPayload,
     int status;
     struct channel_in_use *pciu;
 
-    pciu = MPTOPCIU(mp);
+    pciu = MPTOPCIU(mp, client);
     if(!pciu){
         logBadId ( client, mp, pPayload );
         return RSRV_ERROR;
@@ -1820,7 +1828,7 @@ static int event_add_action (caHdrLargeArray *mp, void *pPayload, struct client
         return RSRV_ERROR;
     }
 
-    pciu = MPTOPCIU ( mp );
+    pciu = MPTOPCIU ( mp, client );
     if ( ! pciu ) {
         logBadId ( client, mp, pPayload );
         return RSRV_ERROR;
@@ -1930,8 +1938,8 @@ static int clear_channel_reply ( caHdrLargeArray *mp,
       * Verify the channel
       *
       */
-     pciu = MPTOPCIU(mp);
-     if(pciu?pciu->client!=client:TRUE){
+     pciu = MPTOPCIU(mp, client);
+     if(!pciu){
          logBadId ( client, mp, pPayload );
          return RSRV_ERROR;
      }
@@ -2039,8 +2047,8 @@ static int event_cancel_reply ( caHdrLargeArray *mp, void *pPayload, struct clie
       * Verify the channel
       *
       */
-     pciu = MPTOPCIU(mp);
-     if (pciu?pciu->client!=client:TRUE) {
+     pciu = MPTOPCIU(mp, client);
+     if (!pciu) {
          logBadId ( client, mp, pPayload );
          return RSRV_ERROR;
      }