bugs in message_facility_

[Jim Lippard <lippard-multicstrac@…>]

Bug 1a: free_msgf_mbx_ptr, line 424
The loop searching for predecessor mailbox pointers can overshoot by one and leave a freed block on the list. A mid-chain block is freed while still linked; a last-in-chain block is neither unlinked nor freed. This can cause a process hang in the message_status command.
This section of code also returns error_table_$unimplemented_version when it should return error_table_$bad_subr_arg, in the case where a supplied pointer doesn’t match message_facility_’s mailbox structures (not a version mismatch).

Bug 1b: get_next_msgf_mbx_ptr, line 290
message_status passes the same variable for both ptr arguments of this entry, so assigning P_next_msgf_mbx_ptr = null () destroys the input pointer before the error recovery on line 304 reads it, causing the recovery to restart at static_msgf_mbx_ptr instead of stepping past the mailbox just freed. The fix makes a copy of the input parameter as input_msgf_mbx_ptr and uses it instead.
These two bugs (1a and 1b) together cause message_status -a to loop; 1a’s fix ends the loop but will still report the mailbox twice; 1b’s fix removes the duplication but by itself doesn’t terminate the loop. (To demonstrate, create and accept messages on three mailboxes, do a message_status -all, then delete the middle mailbox and do message_status -all again.)

Bug 2: wakeup_processor, line 1300
The code tests whether the operation is being done on an “own” mailbox, but calls the non-own entry regardless of the test. The effect is that accept_message wakeups don’t work on a mailbox to which the user has d and o permissions but not r, when the o should govern the outcome.

Bug 3: create_message_array, line 1502
Message existence bits are indexed by array positions, but these positions shift when a newly read message is inserted below existing entries. The bit array is also sized from n_messages on entry, so the shifted index can run past its end. The fix sizes it by n_elements, shifts the bits along with the entries, and widens the array deletion pass to also match.

Bug 4: get_message_index, line 1454
The binary search won’t work if there are holes in the array from deleted messages; this leads to a process hang and false reports of no message. Newly allocated msg_array elements (between n_messages and n_elements) are not cleared; the fix clears them.

Bug 5: print_message, line 1159
The return P_code parameter is not set when message read fails. (The pm command reports nothing when in some cases it should, when there’s a genuine error other than error_table_$no_message.)

Bug 6: set_wakeup_state, line 511
The change_state variable should be initialized at the top; current code uses it before it’s initialized.

Bug 7: get_msgf_mbx_ptr, line 379
A failed open leaves the new block linked, leaving a zombie entry which compounds bug 1.

Bug 8: Minor issues
There’s a missing return statement in an error code ^{= 0 block, there are several places where substr lengths could calculate to a negative number if senders are corrupted or missing, there’s an uninitialized mbx_index variable, and an unnecessary array copy when n_messages = 0.}