id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
207	ISOLTS error message handler can crash on certain message strings.	canthony	Eric Swenson	"{{{
*options?type
*options?tst945

the executive is using unverified instructions-
lcpr
scpr
*options?nohra
ps945 rev a    mpy & div seq test  100681

if type or atype option is in use set cp switch 25 up

*** an error has occurred ***


Error:  out_of_bounds at isolts_err_log_$write|3001
(>user_dir_dir>SysAdmin>Repair>isolts>bound_tolts_)
referencing stack_4|200000 (in process dir)
Attempt to reference beyond end of stack.
}}}

The crash fault occurs in isolts_err_log_.pl1 cv_wmess:

{{{
               if substr (out_str, length (out_str), 1) = NL then /* if trailing newline... */
                    out_str = substr (out_str, 1, length (out_str) - 1); /* get rid of it */
               if substr (out_str, 1, 1) = NL then          /* if leading newline... */
                    out_str = substr (out_str, 2);          /* get rid of it */
}}}

If out_str contains a single NL, the first statement effectively shortens the string to zero length but leaves the NL in place. The second statement does verify the string length before doing the substring, sees the NL and sets up the string copy. It calculates the string length for the substr as ""length (out_str) - 1"". As the length is 0, this causes the generated MLR instruction to receive a length of -1; as the MLR parameters are unsigned, this in interpreted as a length of 2097151, leading to the end-of-stack fault.

The following code change fixes the issue:

{{{
cpa isolts_err_log_.pl1.orig isolts_err_log_.pl1     

A407                          out_str = substr (out_str, 2);          /* get ri
\cd of it */
Changed by B to:
B407                          if length (out_str) < 2 then
B408                            out_str = """";
B409                          else
B410                            out_str = substr (out_str, 2);        /* get ri
\cd of it */

Comparison finished: 1 difference, 5 lines.
}}}
"	defect	closed	major	MR12.8	Tools	MR12.5	fixed