Hi,
I was seeing a crash when connecting remotely with MIDAS_SERVER_HOST. Debugging, it seems to be
because hs_define_panel assumes all of its `var` are 64 bytes (at https://gitlab.triumf.ca/midas/midas/-
/blob/develop/src/history.cxx?ref_type=heads#L3507). But I'm passing in a shorter one. It doesn't happen
when using a local Midas because the local path uses mstrlcpy which stops at the null terminator.
Is there a reason why it has to be 64 bytes? Or can I change it to the minimum of 64 and the string size?
E.g.
- db_set_data_index(hDB, hKeyVar, v.c_str(), 64, i, TID_STRING);
+ db_set_data_index(hDB, hKeyVar, v.c_str(), std::min(64, v.size()), i, TID_STRING);
Output from memory sanitiser is below.
==19362==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400001d93a at pc
0x5555556af004 bp 0x7ffffffc0d70 sp 0x7ffffffc0538
READ of size 64 at 0x60400001d93a thread T0
#0 0x5555556af003 in __interceptor_memcpy
(/build/online/switching_pc/midas_fe/switch_fe_central+0x15b003) (BuildId:
069e8fae8f012afe15b42dd7e819397d7c530852)
#1 0x55555593377c in rpc_call_encode(__va_list_tag (&) [1], RPC_LIST const&, NET_COMMAND**)
/code/midas/src/midas.cxx:13612:13
#2 0x55555591b412 in rpc_call(unsigned int, ...) /code/midas/src/midas.cxx:14295:7
#3 0x555555969585 in db_set_data_index(int, int, void const*, int, int, unsigned int)
/code/midas/src/odb.cxx:8249:14
#4 0x555555a090a6 in hs_define_panel(char const*, char const*,
std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >,
std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >)
/code/midas/src/history.cxx:3507:7
#5 0x555555762c6c in setup_history() /code/online/switching_pc/midas_fe/switch_fe.cpp:454:5 |