Re: side-effect of malloc() in startup file

["Peregrine M. McGehee" <peregrine@lanl.gov>]

The vxWorks tShell crashes after calls to both malloc() and
iocInit within a st.cmd have been traced to the drvTS.c TSinit() 
routine that is called within iocInit. The environment is 
Power PC; VxWorks 5.4; EPICS R3.13.5 and requires definition
of local synchronized timestamp support routines
(http://www.aps.anl.gov/asd/controls/hideos/GTS.html).

This is a consequence of insufficient (none!) range checking for 
access within the TSdata.event_table array of struct timespec
allocated in TSinit(). The quick patch is to always have an
ErSyncEvent() function that returns an event number less than
the return value of ErHaveReceiver() when supplying local 
timestamp support. The harder correction is to rewrite drvTS!

Specifically:
IF
o ErHaveReceiver() is defined and returns a non-zero number of events
(TSdata.total_events).
AND IF
o The sync event number (TSdata.sync_event) exceeds TSdata.total_events 
THEN
possible corruption of vxWorks data structures (in our case we suspect 
the Task Control Block) may occur.

Note that the TSdata.sync_event is defined by ErSyncEvent() if it exists,
otherwise defaults to ER_EVENT_RESET_TICK = 0x7d (a large number!).

This occurs for both Master Timing IOCS (as a result of TSstampServer)
and Slave IOCs (as a result of the TSsyncClient).

- Peregrine
-- 
Peregrine M. McGehee	peregrine@lanl.gov	(505) 667-3273
Sloan Digital Sky Survey / Spallation Neutron Source
MS H820, Los Alamos National Laboratory, Los Alamos, NM 87545