Bounds check m_count / element count against dbChannel.
For write_notify_action only.
Bounds check DBR data size against received payload buffer length
For write_action, add pre-test with dbr_size_n() before caNetConvert()
In this context "CID" means Channel ID,
in this case meaning the server assigned identifier.
While in other contexts this is called SID (Server ID),
to distinguish from the Client ID (also CID :( )
A short message could underflow, leaving a too old client stuck
in a tar pit. An acceptable outcome, but not intended.
Instead, send back errors to each message.
The DBF_UINT64 case dereferenced the 8-byte field as *(epicsUInt32 *),
reading only its low 32 bits, so large UINT64 values printed wrong
(e.g. 0x1_0000_0000 as "0") and save/restore round-tripping broke. Cast
to epicsUInt64*, matching the adjacent DBF_INT64 case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The bin-search loop in add_count() assumes nelm*wdth == ulim-llim, but
wdth is a rounded quotient so nelm*wdth can be strictly less than
ulim-llim. A SGNL value just below ULIM then leaves the loop with
i == nelm+1, and pdest = bptr + nelm writes one epicsUInt32 past the
nelm-element buffer. This is reachable over Channel Access by putting a
value near ULIM to the SGNL field (special SPC_MOD). Clamp the index to
nelm.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The beacon-period gate in online_notify already rejected a parse
failure and a non-positive value, but epicsScanDouble parses "nan" and
"inf", and maxPeriod<=0.0 is false for both, so a non-finite period
reached the beacon delay loop. A NaN maxdelay makes delay<maxdelay
false forever, pinning the beacon interval at the 0.02 s startup value
- a ~50 Hz beacon flood on every configured interface; an infinite
maxdelay lets the doubling delay grow without bound, silencing beacons
entirely.
Gate on finite() (from epicsMath.h), matching the client-side
EPICS_CA_MAX_SEARCH_PERIOD handling in udpiiu.cpp, and name the actual
problem in the diagnostic instead of "float fetch failed" (the message
already covered the non-positive case, which is not a fetch failure).
INPM..INPU each declared special(SPC_MOD), but calcRecord's special()
only implements SPC_CALC and returns S_db_badChoice for anything else.
Every dbPutField/caput to one of those nine link fields therefore ran
special(after=TRUE), hit the fall-through, and failed with
S_db_badChoice ("bad special value") -- nine documented input links
were unwritable at run time.
The twelve sibling links INPA..INPL carry no special and accept writes,
and calcRecord (unlike calcoutRecord) does no run-time link
re-initialization, so there is no handler for SPC_MOD to reach. Remove
the erroneous attribute from the nine fields so they match INPA..INPL;
special() then runs only for CALC, which is the only field that still
carries a special.
In the long-string (%ls) branch dbGetLink(DBR_CHAR) / dbLoadLinkLS can
leave n at vspace+1, so pval[n] = 0 writes at pval[vspace+1], one byte
past the sizv-byte VAL buffer (pval + vspace + 1 == prec->val + sizv).
Clamp n to vspace immediately before writing the terminator.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
putUInt64String used cvtUlongToString, which is cvtUInt32ToString, so the
64-bit source was narrowed to its low 32 bits (e.g. 0x1_0000_0007 printed
as "7"). Use cvtUInt64ToString, matching getUInt64String and every other
width-specific putXxxString.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
get_graphic_double() assigns lower_disp_limit twice and never writes
upper_disp_limit, so a DBR_GR_DOUBLE read of any DLYn field reports
the inverted range lower=10, upper=0. The second assignment was
evidently meant for the upper limit; the 0 in the upper slot is the
zeroed buffer dbAccess.c hands to the RSET, not a chosen value.
Both assignments date from commit 27e80be2e5 which introduced the
DLYn limits, so every release since 3.14.11 reports the inverted
range over both CA (DBR_GR/CTRL) and PVA (display.limitLow/High).
Extend seqTest with a DBR_GR_DOUBLE read of DLY0; the new cases
fail with lower=10, upper=0 before this fix.
The guard used recname[0] = '\0' (assignment) instead of == , which wrote
a NUL into the caller's string, truncating it to "", and evaluated to 0
so recname was left non-NULL pointing at "". Every record then failed
the name comparison and nothing was mapped. Use ==, matching dbjlr.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
get_precision() walks pvalue and plvalue over the A-L and LA-LL fields,
then compares paddr->pfield against &pvalue and &plvalue -- the
addresses of the two local pointer variables, not of the fields they
point at. Those are stack addresses, so neither test has ever matched
and every A-L or LA-LL precision request falls through to
recGblGetPrec(). The line just above gets it right: prec->val is a
field and needs the &, whereas pvalue and plvalue are already pointers.
Both tests date from e87551df24, the commit that added the loop, and
have been dead ever since, so every release since R3.12 has this. They
carried a (void *) cast until 6d85a36397 removed it, which is why the
compiler was never shown a double ** to complain about. That the
fields were meant to be covered is not in doubt: this record's
get_graphic_double() and get_control_double() both name A-L and LA-LL.
This changes what those fields report. recGblGetPrec() substitutes 15
for a DOUBLE precision outside 0 to 15, so today A-L and LA-LL answer
15 for a PREC of 17 while VAL answers 17. They now answer PREC
unclamped, which is what VAL has always done.
Add selTest, reading the precision of VAL, A, L, LA, LL and HIHI from a
record with PREC=17. The four A-L and LA-LL cases report 15 before
this fix; VAL and HIHI pin the two paths either side of them.
* Add GDB helper script
Pretty printing of some common argument types
Need to add a line to ~/.gdbinit
> add-auto-load-safe-path /path/to/base/checkout/
afterwards verify at GDB shell with
> info auto-load python-scripts
> info pretty-printer
Tested with GDB 16.3 circa Debian 13
Add $rcast(dbCommon) to up-cast
Add $record("name") to lookup record
Add $elln(ELLLIST,#) to index into list
../rec/biRecord.c:191:42: warning: argument to ‘sizeof’ in ‘strncpy’
call is the same expression as the source; did you mean to use the
size of the destination? [-Wsizeof-pointer-memaccess]
191 | strncpy(pstring,prec->znam,sizeof(prec->znam));
| ^
Use memcpy instead of snprintf.
STATIC_ASSERT is added to ensure znam and onam are sized enough.
Debugging a problem and looking at the message
recGblDbaddrError: dbPut: Request type is 0 Illegal Database Request Type...
does not help very much: request type 0 is a legal value.
Improve the message to show the field type as well:
recGblDbaddrError: dbPut: dbrType = 0 field_type = DBF_INLIK (14)...
Do the same for both dbPut and dbGet.
After connectCallback, need to wait for up to three
concurrent actions. Native and string subscriptions,
as well as GET of metadata.
Complicated because event_handler_args does not identify
the evid.
see 717d69e1fc
* Add AFTC feature to bi record with tests.
* Fix broken AFTC handling for mbbi record, also fix bug in COSV and LALM handling.
* Add release notes and update record docs.
* skeleton for implementation of dbCreateRecord iocsh exposure
* Add functionality of dbCreateRecordCallFunc
Includes adding dependancy to iocInit.h and a new error type in dbStaticLib.h
* Fix error message for case when adding record to IOC post init
* add new error message for when no record name is passed and check for empty strings
* add release note for dbCreateRecord IOC shell command
* fix issues from codeql in release notes
* fix documentation md based on codacy styling
eg. After running "false > $@", the output file modification
time will be updated. So a despite failure, a repeated
"make" will not re-run.
Handle this by accumulating output to "$@.tmp", then
move to $@ as a final step.
Michael Davidsaver
zimoch