epics-modules / ip

APS BCDA synApps module: ip
http://epics-modules.github.io/ip/
Other
3 stars 9 forks source link

Ticket12: Fix buffer overflow in Keithley 2k #13

Closed ghost closed 5 years ago

ghost commented 6 years ago

Description of Work Done

Issue this addresses

12

ghost commented 5 years ago

Updated using PVNAME_STRINGSZ.

MarkRivers commented 5 years ago

strncpy() will not 0 terminate the destination if the size of the source is >= N. I think those statements should be sizeof(model)-1 and sizeof(close_format)-1 in order to guarantee that the destination is 0 terminated.

I realized strncpy with sizeof(model)-1 also does not 0 terminate the string. I changed back to sizeof(model), and then explicitly make the last character be 0 in case the size was >=sizeof(model). I did the same for close_format.


            P = macValueGet("P");
            Dmm = macValueGet("Dmm");
            strncpy(model, macValueGet("model"), sizeof(model));
            model[sizeof(model)-1] = 0;
            pvPut(model);
            channels = atoi(macValueGet("channels"));
            pvPut(channels);
            if (strcmp(model, "2000") == 0) {
               strncpy(close_format, "rout:clos (@%d)", sizeof(close_format));
            } else {
               strncpy(close_format, "rout:clos (@1%2.2d)", sizeof(close_format));
            }
            close_format[sizeof(close_format)-1] = 0;
        } state monitor_mode_changes

I made these same changes in Keithley2kDMM_mf40.st and Keithley65xxEM.st and pushed to master branch.