[Bug 1776141] Re: Buffer overrun in dbpr with long INP field

[Launchpad Bug Tracker via Core-talk <core-talk at aps.anl.gov>]

** Merge proposal linked:
   https://code.launchpad.net/~info-martin-konrad/epics-base/+git/epics-base/+merge/393873

-- 
You received this bug notification because you are a member of EPICS
Core Developers, which is subscribed to EPICS Base.
Matching subscriptions: epics-core-list-subscription
https://bugs.launchpad.net/bugs/1776141

Title:
  Buffer overrun in dbpr with long INP field

Status in EPICS Base:
  Fix Released
Status in EPICS Base 3.15 series:
  In Progress
Status in EPICS Base 3.16 series:
  Fix Released
Status in EPICS Base 7.0 series:
  Fix Released

Bug description:
  softIoc crashes with a buffer overflow in dbTest.c:1152 when running
  "dbpr A 4" on the attached database file (test.db).

  Root cause: pmsg points to msgBuff->message which has a fixed size of
  128 but the output of sprintf can be longer.

  I can see two potential solutions here:

  1. Use snprintf() to prevent the buffer overflow.
  2. Convert the file to C++ and use strings.

  Note: dbTest.c contains a total of 23 sprintf() calls so there might
  be potential for more issues...

To manage notifications about this bug go to:
https://bugs.launchpad.net/epics-base/+bug/1776141/+subscriptions