#89 ALM buffer overrun
ALM 8.14 has a buffer overrun bug related to the pathname length of the source file being assembled.
"alm_symtab_" uses "prname_" to place the source file path in the listing file.
"prnam_" uses the buffer oulst to return the formatted string.
"oulst" is declared in "prnam_.pl1" and "als_.pl1" as
dcl 1 eb_data_$oulst external, 2 oulst char(68) aligned;
and is defined in "eb_data_.alm" as
segdef oulst
oulst: bss oulst,17
A sufficently long source file path will overrun the buffer and damage ALM's data structures leading to a variety of issues depending on the path length and contents. Out-of-bounds and phase errors have been observed.
As a test, the ALM source was modifed, changing the length of "oulst" to "char (168)", the "bss oulst" to ",42" and "srclen = 68" to "168" in the files "alm_.pl1", "eb_data.alm" and "prnam_.pl1".
After the changed, my test script ran without error.
The source code needs to be reviewed to determine to correct size of "outst", taking into account the Multics maximum path length and "prnam_" overhead, and that all relevant code is fixed.
AG-91, pg 3-1: Entry name max. length is 32 characters/
AG-91, pg 3-2 'A maximum of 16 levels of directories is allowed from the root to the final entryname.'
16 levels is 16 * (32 + 1 [for the '>]) + 32 [the entryname] +1 [for the '>']
16 * 33 + 33
17 * 33
561 characters.
MCR10002 implemented Charles' fix to ALM for this issue. However, there was discussion as to whether this was the correct fix, so leaving this ticket open for further discussion.
The only issue I have is the details of the implementation; should the manifest constant 168 be replaced with the Multics equivilent of the "MAX_PATH_LEN"
Closing as ticket moved here: http://multics-trac.swenson.org/ticket/22