Experimental Physics and
Industrial Control System

Michael Davidsaver via Tech-talk <tech-talk at aps.anl.gov> · Wed, 19 Jun 2024 21:26:07 -0700

Hi Jörn,

On 6/19/24 05:47, Jörn Dreyer via Tech-talk wrote:

Hi Ralph,

after some more thinking and investigation, I found a more propper fix for the problem. If one adds the following two lines to

base/configure/os/CONFIG_SITE.linux-x86_64.UnixCommon

CFLAGS += -D_FORTIFY_SOURCE=2
CXXFLAGS += -D_FORTIFY_SOURCE=2

the code gets compiled with the old setting of _FORTIFY_SOURCE. Thats only a temporary fix of course. Clearly the code should be fixed for this errors.


I think this is reasonable.  I have an unpleasant suspicion that
we will be seeing with these "errors" for some time.

It took me awhile to understand that:


*** buffer overflow detected ***: terminated


should actually be understood as "buffer overflow predicted".
And this is in all likelihood a false positive.


If you can, it would be helpful if you could gather some more
information to help us reproduce this fault.  Either by finding
a reduced test case which triggers the fault, or in probing further
with debug prints.  (As far as I can tell, the extra information
used by the fortify checks in not available to the debugger)

The stack trace you shows that access is to a ENUM or MENU field
of an aiRecord.  Which field?

The trace points to the strncpy() at dbAccess.c:192 .
(which interestingly seems to be compiled into a plain strcpy() )


https://urldefense.us/v3/__https://github.com/epics-base/epics-base/blob/772c10d904c2c149ce2154996091858514f27265/modules/database/src/ioc/db/dbAccess.c*L192__;Iw!!G_uCfscf7eWS!Yp-ntUckX3N6O8iHjWlGFPCp1L9RPDJG24HtOKaNMNroby7MnOeAdw-CqP-1vx-kISxEFyPDM0pgiaBGES1Dz6LGIw$



Could you try applying the attached patch, which adds some debug prints?

I see something like the following.  All of the 'f's mean that GCC
is unable to track the sizes of the objects involved.  I also don't
see a fault.


X test.LINR ptemp=ffffffffffffffff,ffffffffffffffff papChoice=ffffffffffffffff,ffffffffffffffff i=0

diff --git a/modules/database/src/ioc/db/dbAccess.c b/modules/database/src/ioc/db/dbAccess.c
index c9d39c57c..1b55aabbf 100644
--- a/modules/database/src/ioc/db/dbAccess.c
+++ b/modules/database/src/ioc/db/dbAccess.c
@@ -191,6 +191,13 @@ choice_common:
                     for (i=0; i<no_str; i++) {
                         if(papChoice[i]==NULL) *ptemp=0;
                         else {
+                            fprintf(stderr, "X %s.%s ptemp=%zx,%zx papChoice=%zx,%zx i=%u\n",
+                                    paddr->precord->name, paddr->pfldDes->name,
+                                    __builtin_dynamic_object_size(ptemp, 0),
+                                    __builtin_dynamic_object_size(ptemp, 1),
+                                    __builtin_dynamic_object_size(papChoice, 0),
+                                    __builtin_dynamic_object_size(papChoice, 1),
+                                    i);
                             strncpy(ptemp,papChoice[i],
                                 sizeof(pdbr_enumStrs->strs[0]));
                             *(ptemp+sizeof(pdbr_enumStrs->strs[0])-1) = 0;


Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System