RE: db_create_event_log

["Hill, Jeff" <johill@lanl.gov>]

Maybe I see another R3.15 bug; when in an out-of-memory situation the code in the filter arr.c at line 122 allocates pdst but does not check the return from freeListCalloc. If it is nill then u.r.field will also be nill. It seems that further down in arr.c at line 127 dbExtractArrayFromBuf will memcpy to a nill pointer destination if u.r.field is nill?

                void *pdst = freeListCalloc(my->arrayFreeList);

                pfl->u.r.dtor = freeArray;
                pfl->u.r.pvt = my->arrayFreeList;
                offset = (offset + start) % chan->addr.no_elements;
                dbExtractArrayFromRec(&chan->addr, pdst, nTarget, nSource, offset, my->incr);
                pfl->u.r.field = pdst;

It seems that similar issues exist further down in arr.c at line 143 where dbExtractArrayFromBuf will memcpy to a nill pointer destination when u.r.field is initialized nill, in an out-of-memory situation?

            pdst = freeListCalloc(my->arrayFreeList);
            offset = start;
            dbExtractArrayFromBuf(psrc, pdst, pfl->field_size, pfl->field_type, nTarget, nSource, offset, my->incr);

Looking in the source it appears that there are several additional defects following this pattern.

Should I submit a bug report?

Jeff
> -----Original Message-----
> From: core-talk-bounces@aps.anl.gov [mailto:core-talk-
> bounces@aps.anl.gov] On Behalf Of Hill, Jeff
> Sent: Monday, November 04, 2013 11:06 AM
> To: core-talk@aps.anl.gov
> Subject: db_create_event_log
> 
> Hello All,
> 
> I was having a closer look at the recent changes in R3.15; my perception is
> that behavior has changed and that in an out-of-memory situation R3.15 is
> currently discarding the update for the event queue instead of the original
> behavior which was replacing the last entry on the queue for the subscription
> that was being posted, in an out-of-memory situation.
> 
> Should I submit a defect report; or perhaps this was this an intentional
> behavior change in R3.15?
> 
> Ref: in the code below if db_create_event_log returns null due to out-of-
> memory condition then db_post_events is a noop.
> 
> int db_post_events(
> void            *pRecord,
> void            *pField,
> unsigned int    caEventMask
> )
> {
>     struct dbCommon   * const prec = (struct dbCommon *) pRecord;
>     struct evSubscrip *pevent;
> 
>     if (prec->mlis.count == 0) return DB_EVENT_OK;       /* no monitors set */
> 
>     LOCKREC (prec);
> 
>     for (pevent = (struct evSubscrip *) prec->mlis.node.next;
>         pevent; pevent = (struct evSubscrip *) pevent->node.next){
> 
>         /*
>          * Only send event msg if they are waiting on the field which
>          * changed or pval==NULL and waiting on alarms and alarms changed
>          */
>         if ( (dbChannelField(pevent->chan) == (void *)pField || pField==NULL) &&
>             (caEventMask & pevent->select)) {
>             db_field_log *pLog = db_create_event_log(pevent);
>             pLog = dbChannelRunPreChain(pevent->chan, pLog);
>             if (pLog) db_queue_event_log(pevent, pLog);
>         }
>     }
> 
>     UNLOCKREC (prec);
>     return DB_EVENT_OK;
> 
> }
>