Back Midas Rome Roody Rootana
  Midas DAQ System  Not logged in ELOG logo
Message ID: 3277     Entry time: 24 Sep 2026
Author: Mark Grimes 
Topic: Bug Report 
Subject: Buffer overflow in hs_define_panel when remote 
Hi,
I was seeing a crash when connecting remotely with MIDAS_SERVER_HOST. Debugging, it seems to be 
because hs_define_panel assumes all of its `var` are 64 bytes (at https://gitlab.triumf.ca/midas/midas/-
/blob/develop/src/history.cxx?ref_type=heads#L3507). But I'm passing in a shorter one. It doesn't happen 
when using a local Midas because the local path uses mstrlcpy which stops at the null terminator.

Is there a reason why it has to be 64 bytes? Or can I change it to the minimum of 64 and the string size? 
E.g.

-      db_set_data_index(hDB, hKeyVar, v.c_str(), 64, i, TID_STRING);
+      db_set_data_index(hDB, hKeyVar, v.c_str(), std::min(64, v.size()), i, TID_STRING);


Output from memory sanitiser is below.


==19362==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400001d93a at pc 
0x5555556af004 bp 0x7ffffffc0d70 sp 0x7ffffffc0538
READ of size 64 at 0x60400001d93a thread T0
    #0 0x5555556af003 in __interceptor_memcpy 
(/build/online/switching_pc/midas_fe/switch_fe_central+0x15b003) (BuildId: 
069e8fae8f012afe15b42dd7e819397d7c530852)
    #1 0x55555593377c in rpc_call_encode(__va_list_tag (&) [1], RPC_LIST const&, NET_COMMAND**) 
/code/midas/src/midas.cxx:13612:13
    #2 0x55555591b412 in rpc_call(unsigned int, ...) /code/midas/src/midas.cxx:14295:7
    #3 0x555555969585 in db_set_data_index(int, int, void const*, int, int, unsigned int) 
/code/midas/src/odb.cxx:8249:14
    #4 0x555555a090a6 in hs_define_panel(char const*, char const*, 
std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, 
std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >) 
/code/midas/src/history.cxx:3507:7
    #5 0x555555762c6c in setup_history() /code/online/switching_pc/midas_fe/switch_fe.cpp:454:5
ELOG V3.1.6-083448f7