epics/epics-base
0
0
Fork 0
Code Issues Pull Requests Projects Wiki Activity

ioc/rsrv: bounds check DBR

Browse Source 
avoid array overrun when evaluating dbr_size_n() macro.
This commit is contained in:
Michael Davidsaver
2017-05-03 16:42:19 -04:00
parent 38be82a154
commit e430d097b7
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/rsrv/camessage.c
View File

@@ -737,6 +737,10 @@ static int read_notify_action ( caHdrLargeArray *mp, void *pPayload, struct clie
struct channel_in_use *pciu;
struct event_ext evext;
if ( INVALID_DB_REQ(mp->m_dataType) ) {
return RSRV_ERROR;
}
pciu = MPTOPCIU ( mp );
if ( !pciu ) {
logBadId ( client, mp, pPayload );
@@ -1845,6 +1849,10 @@ static int event_add_action (caHdrLargeArray *mp, void *pPayload, struct client
struct channel_in_use *pciu;
struct event_ext *pevext;
if ( INVALID_DB_REQ(mp->m_dataType) ) {
return RSRV_ERROR;
}
pciu = MPTOPCIU ( mp );
if ( ! pciu ) {
logBadId ( client, mp, pPayload );