ISOLTS error message handler can crash on certain message strings.

[canthony]

*options?type
*options?tst945

the executive is using unverified instructions-
lcpr
scpr
*options?nohra
ps945 rev a    mpy & div seq test  100681

if type or atype option is in use set cp switch 25 up

*** an error has occurred ***


Error:  out_of_bounds at isolts_err_log_$write|3001
(>user_dir_dir>SysAdmin>Repair>isolts>bound_tolts_)
referencing stack_4|200000 (in process dir)
Attempt to reference beyond end of stack.

The crash fault occurs in isolts_err_log_.pl1 cv_wmess:

               if substr (out_str, length (out_str), 1) = NL then /* if trailing newline... */
                    out_str = substr (out_str, 1, length (out_str) - 1); /* get rid of it */
               if substr (out_str, 1, 1) = NL then          /* if leading newline... */
                    out_str = substr (out_str, 2);          /* get rid of it */

If out_str contains a single NL, the first statement effectively shortens the string to zero length but leaves the NL in place. The second statement does verify the string length before doing the substring, sees the NL and sets up the string copy. It calculates the string length for the substr as "length (out_str) - 1". As the length is 0, this causes the generated MLR instruction to receive a length of -1; as the MLR parameters are unsigned, this in interpreted as a length of 2097151, leading to the end-of-stack fault.

The following code change fixes the issue:

cpa isolts_err_log_.pl1.orig isolts_err_log_.pl1     

A407                          out_str = substr (out_str, 2);          /* get ri
\cd of it */
Changed by B to:
B407                          if length (out_str) < 2 then
B408                            out_str = "";
B409                          else
B410                            out_str = substr (out_str, 2);        /* get ri
\cd of it */

Comparison finished: 1 difference, 5 lines.

[Eric Swenson]

When I apply the proposed fix, I no longer get the out_of_bounds fault, but I seem to get into an unending loop displaying:

*options?tst945

the executive is using unverified instructions-
lcpr
scpr
*options?nohra
ps945 rev a    mpy & div seq test  100681

if type or atype option is in use set cp switch 25 up

*** an error has occurred ***


*** an error has occurred ***


*** an error has occurred ***


*** an error has occurred ***

After many pages of this, I send a QUIT to itolts_ and am able to exit.

Has tst945 always done this? Is this what happened for you when you applied this fix?

[Eric Swenson]

After conversations with Charles on this subject (and some new support to the simulator, provided by Jeff), I'm now able to get a bit further. By setting switch 25 "up" (on, 1), with the "set cpu1 config=data=000030716000" command, I'm able to run test ps945, and I only get two instances of the "an error has occurred message" and then things seem to hang. But I can issue a QUIT signal, and then use the "derr" isolts command to display detailed error information.

So I'm going to enter an MCR for the above fix, which does appear to be needed to prevent the out_of_bounds fault.

[Eric Swenson]

​https://s3.amazonaws.com/eswenson-multics/public/mcrs/MCR10135-v1.0.pdf

[Eric Swenson]

Updated MCR with a better fix: ​https://s3.amazonaws.com/eswenson-multics/public/mcrs/MCR10135-v1.1.pdf

[Eric Swenson]

Fixed in MR12.8-1060.