caput of escaped strings to CHAR array send too large array count

[Dirk Zimoch]

When a string is written to a CHAR array, the array count is set to string length+1 (includes terminating 0 byte).

But when escape sequences are used, the byte count does not get adjusted. Thus a sequence like "\a" sends 3 bytes (7 0 0), not 2.

This is the piece of code in question (caput.c). See how the result of epicsStrnRawFromEscaped is not used to update count.

        if (charArrAsStr) {
            count = len;
            dbrType = DBR_CHAR;
            ebuf = calloc(strlen(cbuf)+1, sizeof(char));
            if(!ebuf) {
                fprintf(stderr, "Memory allocation failed\n");
                return 1;
            }
            epicsStrnRawFromEscaped(ebuf, strlen(cbuf)+1, cbuf, strlen(cbuf));
        } else {

The bug appeared together with the -S option (3.14.12 ?) and can still be found in 3.15.1.

The bug is relatively harmless because it simply sends too many trailing 0 bytes.

[Andrew Johnson (anj)]

How many times can one short piece of code call strlen() on the same string?

[Dirk Zimoch (dirk.zimoch)]

On 07.04.2015 17:00, Andrew Johnson wrote:
> How many times can one short piece of code call strlen() on the same
> string?

Crazy, isn't it? Especially since len already contains the length. Maybe
someone's mind was too much adjusted to PASCAL where the length
operation needs constant time?