#5 ADFI_string_2_C_String oversteps character string size

[David Car]

This isn't a bug in ADFI_String_2_C_String per say, but rather many of the routines that call it. What happens is that this function is being passed character strings which are smaller than the specified string_length parameter and the internal for loop is accessing memory beyond the size of the passed in string argument. In many places you are calling cgi_new_node(...) with a fixed character string of "R4" for instance which is turn may call cgio_set_dimensions(...), eventually calling ADFI_string_2_C_string(...) with a value of string_length equal to ADF_DATA_TYPE_LENGTH, but you passed in a character constant of length 2, so you access memory outside the bounds of string. So to repeat, the call path is:

cgi_new_node -> cgio_set_dimensions -> ADF_Put_Dimension_Information -> ADF_evaluate_datatype -> ADFI_string_2_C_string

If cgi_new_node is called with data_type="R4" or some such, this will be a problem as you will exceed the memory region of string in ADFI_string_2_C_string(...) when performing the copy. An easy fix is to not use a character constant in the actual calls, but to define a ADF_DATA_TYPE_LENGTH length character constant in the header for things such as "I4", "R4", etc... Also, they should be used in the cgi_adf_datatype(...) function as well. Thanks.