id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
323	ssu_$print_message, $abort_line, $abort_subsystem and ssu_ec_ call  ssu_check_sci incorrectly.	Gary Dixon	Gary Dixon	"The internal procedure ssu_check_sci (code resides in _ssu.check_sci.incl.pl1) checks validity of the
Psci_ptr parameter passed to many ssu_ entry points and requests.  Several ssu_ subroutines accept a variable number of arguments, and therefore check carefully whether their first argument is actually an sci_ptr value by passing that pointer to the ssu_check_sci subroutine.

That subroutine actually checks for an ITS modifier (043 octal) at end of the first word of the aligned Psci_ptr value.  If that modifier is not present, the value stored is not actually a real pointer value.  The ssu_check_sci routine wants to diagnose that fact.

However, two routines that call ssu_check_sci mistakenly copy the given value to a pointer argument and then pass this copied argument for testing by ssu_check_sci.  From ssu_error_.pl1, the following lines show this copy before calling the test subroutine:


{{{
 call decode_descriptor_ (arg_list_ptr, 1, arg_type, arg_packed, arg_ndims, 
     arg_size, arg_scale);
 if (arg_type ^= pointer_dtype) | (arg_packed ^= ""0""b) | (arg_ndims ^= 0) then 
     call ssu_check_sci (null ());                 /* not a pointer */
                                                  
 sci_ptr = arg_ptr -> based_pointer;               /* got it */

 call ssu_check_sci (sci_ptr);                     /* validate it */
}}}

Unfortunately, the copy uses instructions that depend upon existence of a valid ITS modifier in the source pointer stored value.


{{{
                                                            STATEMENT 1 ON LINE 126
          sci_ptr = arg_ptr -> based_pointer;

000274  aa  6 00104 3735 20   epp7      pr6|68,*            based_pointer
000275  aa  7 00000 3735 20   epp7      pr7|0,*             based_pointer
000276  aa  6 01200 6535 00   spri7     pr6|640             sci_ptr
}}}

The epp7 instruction at offset 000275 will perform in unknown ways if an ITS modifier does not appear in the modifier field of the stored pointer value.  

The corrected code (shown below) should pass the incoming argument to the test procedure for validation.  If it validates correctly, the incoming pointer can then be copied to the local pointer variable.


{{{
pr ssu_error_.p -fm 123 -for 6 -nb
     123            if (arg_type ^= pointer_dtype) | (arg_packed ^= ""0""b) | (arg_ndims ^= 0) then call ssu_check_sci (null ());
     124                                                              /* not a pointer */
     125  
     126            call ssu_check_sci (arg_ptr -> based_pointer);    /* validate it */
     127  
     128            sci_ptr = arg_ptr -> based_pointer;               /* got it */
}}}

First, a breakpoint is set before line 126 of the revised code.

{{{
pb ssu_error_
Using >user_dir_dir>Multics>GDixon>work>ssu_parms>ssu_error_ (no active frame).
ps 126
          call ssu_check_sci (arg_ptr -> based_pointer);
b: (v arg_ptr;h)
Break set before line 126
q
r 14:10 0.222 5 level 2
}}}

Then a null pointer is passed as the first (only) argument to one of the ssu_error_ entry points.  You can see that the ssu_check_sci code is correctly diagnosing the first argument being a null() pointer value.

{{{
call ssu_error_$print_message -in -1|1 -dcl ptr

arg_ptr = 416|562   [pd]>!BBBKXHqPPzKKMc.temp.0416
Stopped before line 126 of ssu_error_. (level 23)
c

Error:  Attempt by >udd>m>gd>w>ssup>ssu_error_$print_message|1271 (line 53)
to reference through null pointer
r 14:11 0.280 2 level 3

rl
r 14:11 0.027 0 level 2
}}}

Running the test again, I used debug to change the modifier field (and the offset field of the pointer) to different values, most importantly setting the ITS modifier value to 000.

{{{
call ssu_error_$print_message -in -1|1 -dcl ptr

arg_ptr = 416|562   [pd]>!BBBKXHqPPzKKMc.temp.0416
Stopped before line 126 of ssu_error_. (level 23)
..db 
/416/562,o2
   562    562 077777400043 000000000001
= 0777774400000
Changing 416|562
077777400043 to 777774400000
.q
c

Error:  ssu_ error by >udd>m>gd>w>ssup>ssu_error_$print_message|1216 (line 42)
Argument is not an ITS pointer. 777774400000000000000001

r 14:12 0.421 1 level 3
}}}

That is the intended result of such tests.

Two of the ssu_ subroutines have this problem:  ssu_error_.pl1 and ssu_ec_.pl1.  Both should be corrected as shown above.
"	defect	accepted	major		Standard Library	MR12.8