From fb09dc0df99dafdf6e5ef751a911282a22ba4eb8 Mon Sep 17 00:00:00 2001 From: Freddie Akeroyd Date: Tue, 17 Mar 2026 19:52:34 +0000 Subject: [PATCH] Fix memory overwrite in macParseDefns --- modules/libcom/src/macLib/macUtil.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/libcom/src/macLib/macUtil.c b/modules/libcom/src/macLib/macUtil.c index 920ac006f..5c04c9075 100644 --- a/modules/libcom/src/macLib/macUtil.c +++ b/modules/libcom/src/macLib/macUtil.c @@ -62,8 +62,11 @@ epicsStdCall macParseDefns( printf( "macParseDefns( %s )\n", defns ); /* allocate temporary pointer arrays; in worst case they need to have - as many entries as the length of the defns string */ - numMax = strlen( defns ); + as many entries as the length of the defns string + 2 + for defns="1,3,5" give 3 pairs so num will be 6 (strlen(defns)+1) + but as num is used as an index e.g. del[num] we need + numMax to be strlen(defns) + 2 */ + numMax = strlen( defns ) + 2; if ( numMax < altNumMax ) numMax = altNumMax; ptr = (const char **) calloc( numMax, sizeof( char * ) );