id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
22	ALM buffer overrun (MCR10002)	Eric Swenson	Eric Swenson	"ALM 8.14 has a buffer overrun bug related to the pathname length of the source file being assembled.
""alm_symtab_"" uses ""prname_"" to place the source file path in the listing file.
""prnam_"" uses the buffer oulst to return the formatted string.
""oulst"" is declared in ""prnam_.pl1"" and ""als_.pl1"" as

{{{
dcl       1 eb_data_$oulst external, 2 oulst char(68) aligned;
}}}

and is defined in ""eb_data_.alm"" as

{{{
    segdef  oulst
oulst:  bss oulst,17
}}}

A sufficently long source file path will overrun the buffer and damage ALM's data structures leading to a variety of issues depending on the path length and contents. Out-of-bounds and phase errors have been observed.

As a test, the ALM source was modifed, changing the length of ""oulst"" to ""char (168)"", the ""bss oulst"" to "",42"" and ""srclen = 68"" to ""168"" in the files ""alm_.pl1"", ""eb_data.alm"" and ""prnam_.pl1"".

After the changed, my test script ran without error.

The source code needs to be reviewed to determine to correct size of ""outst"", taking into account the Multics maximum path length and ""prnam_"" overhead, and that all relevant code is fixed.
"	defect	closed	major	MR12.8	Tools	MR12.6d	wontfix