#123 OnBC: Buffer Overflow Causes Fatal Exception

[Dale Hurtt]

From an error reported on the Yahoo Discussion Forum:

> I recently increased the size of one of my structures
> (stored as a global) from 13x13x10 (=1690) bytes to
> 13x13x50+1024 (=9474) bytes.
> Now I'm getting the following errors, in order, when I
> compile:

> "Data buffer overrun, line 575."

I believe it is in OnBoardC.c:

void writeToDataBuffer(char *ptr, int length)
{
if ((gDataTop + length) >= 4096) {
[snip]
if (gDataContentStackTop == 8) {
error("Data buffer overrun");
return;
}
[snip]
}

I have not found the link between the first error and the
second yet.

> "Couldn't grow output buffer, line 1080."

void assureOutput(ULong length)
{
if ((outputTop + length) >= outputSize) {
[snip]
if (outputHandle == NULL) {
error("Couldn't grow output buffer");
return;
}
[snip]
}

> "Fatal Alert: DataMgr.c, Line:7394,
> DmWrite:DmWriteCheck failed."
> (this last one gives me a reset button which doesn't
> work, so I have to poke the back of my PDA.)

Caused by:

void addToOutput(CharPtr contents, ULong length)
{
assureOutput(length);
DmWrite(outputBuffer, outputTop, contents, length);
outputTop += length;
}

Note that assureOutput generated an error:

if (outputHandle == NULL) {
error("Couldn't grow output buffer");
return;

Then addToOutput does not check if the global
outputBuffer, which was set by assureOutput, is NULL.

assureOutput(length);
DmWrite(outputBuffer, outputTop, contents, length);

Dale

[Dale Hurtt]

Logged In: YES
user_id=946828

It will be a QuickFix, so it will be in the next release.

[John Wilund]

Logged In: YES
user_id=574706
Originator: NO

Steve, just apply the changes discussed in the description...
I made you PoC for this one...