Skip to content

Commit ce35c27

Browse files
physwkimmdavidsaver
authored andcommitted
ioc: getArrayValue() size output buffer based on final_type only
Handle some incorrectly defined dbChannel, to at least not crash. getArrayValue sized the read buffer from dbChannelFinalFieldSize, but dbGet writes dbValueSize(final_type) bytes per element — MAX_STRING_SIZE for a DBR_STRING request, regardless of the field's own size — so a DBF_STRING field with field_size < MAX_STRING_SIZE (synApps scalcout PAA..PLL) overflowed the heap. Size by dbValueSize(final_type): unchanged for numeric fields and type-changing filters (dbValueSize == field_size there), MAX_STRING_SIZE for strings.
1 parent a2828d0 commit ce35c27

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

ioc/iocsource.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ void getArrayValue(dbChannel* pChannel,
121121
Value& value)
122122
{
123123
auto final_type(dbChannelFinalFieldType(pChannel));
124-
auto buf(std::make_shared<std::vector<char>>(dbChannelFinalElements(pChannel) * dbChannelFinalFieldSize(pChannel)));
124+
auto buf(std::make_shared<std::vector<char>>(dbChannelFinalElements(pChannel) * dbValueSize(final_type)));
125125
long nReq = dbChannelFinalElements(pChannel);
126126

127127
DBErrorMessage dbErrorMessage(dbChannelGet(pChannel, final_type,

0 commit comments

Comments
 (0)