Experimental Physics and
Industrial Control System

mdavidsaver via Core-talk <core-talk at aps.anl.gov> · Wed, 12 Feb 2020 10:31:35 -0000

I find only two places where pushDatagramMsg() is called.  One with
pExt!=NULL, and the other with pExt==NULL && extsize==0.  So this won't
currently trigger a issue.  I see no harm in adding a NULL test for
pExt, or an assert() that pExt==NULL requires extsize==0.

-- 
You received this bug notification because you are a member of EPICS
Core Developers, which is subscribed to EPICS Base.
Matching subscriptions: epics-core-list-subscription
https://bugs.launchpad.net/bugs/1862916

Title:
  Possible null pointer dereferencing in
  modules/ca/src/client/udpiiu.cpp

Status in EPICS Base:
  New

Bug description:
  Codacy report an Error level issue on a possible null pointer
  dereferencing  modules/ca/src/client/udpiiu.cpp line 950.

  If the function bool udpiiu::pushDatagramMsg ( epicsGuard < epicsMutex > & guard, const caHdr & msg, const void * pExt, ca_uint16_t extsize ) is called with the following parameters:
  1) pExt == null
  2) extsize > 0

  This will cause the memcpy to read extsize bytes from null, presumably
  crashing the code.

To manage notifications about this bug go to:
https://bugs.launchpad.net/epics-base/+bug/1862916/+subscriptions

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System