From fde8e4ca2ecf01d7a326d14ca4aa61f835842813 Mon Sep 17 00:00:00 2001 From: Jacqueline Garrahan Date: Tue, 14 Jul 2026 15:19:32 -0700 Subject: [PATCH] histogramRecord: fix heap OOB write when SGNL approaches ULIM The bin-search loop in add_count() assumes nelm*wdth == ulim-llim, but wdth is a rounded quotient so nelm*wdth can be strictly less than ulim-llim. A SGNL value just below ULIM then leaves the loop with i == nelm+1, and pdest = bptr + nelm writes one epicsUInt32 past the nelm-element buffer. This is reachable over Channel Access by putting a value near ULIM to the SGNL field (special SPC_MOD). Clamp the index to nelm. Co-Authored-By: Claude Opus 4.8 (1M context) --- modules/database/src/std/rec/histogramRecord.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/database/src/std/rec/histogramRecord.c b/modules/database/src/std/rec/histogramRecord.c index 18ae57d12..6418e10ba 100644 --- a/modules/database/src/std/rec/histogramRecord.c +++ b/modules/database/src/std/rec/histogramRecord.c @@ -338,7 +338,8 @@ static long add_count(histogramRecord *prec) return 0; temp = prec->sgnl - prec->llim; - for (i = 1; i <= prec->nelm; i++){ + /* stop at nelm-1 so a rounded wdth can't push i past the last bin */ + for (i = 1; i < prec->nelm; i++){ if (temp <= (double) i * prec->wdth) break; }