beremiz

fixed bug : buffer overflow when debugging PLC with python blocks

2009-04-10, greg
c5f3f71e7260
Parents b4131e5d10a4
Children ae3488c79283
fixed bug : buffer overflow when debugging PLC with python blocks
2 files changed, 29 insertions(+), 3 deletions(-)
  • +24 -0
    plugger.py
  • +5 -3
    targets/plc_debug.c
    • --- a/plugger.py Thu Apr 09 15:27:45 2009 +0200
    +++ b/plugger.py Fri Apr 10 07:53:42 2009 +0200
    @@ -629,6 +629,27 @@
    # Construct debugger natively supported types
    DebugTypes = [t for t in zip(*TypeHierarchy_list)[0] if not t.startswith("ANY")] + \
    ["STEP","TRANSITION","ACTION"]
    +DebugTypesSize = {"BOOL" : 1,
    + "STEP" : 1,
    + "TRANSITION" : 1,
    + "ACTION" : 1,
    + "SINT" : 1,
    + "USINT" : 1,
    + "BYTE" : 1,
    + "STRING" : 128,
    + "INT" : 2,
    + "UINT" : 2,
    + "WORD" : 2,
    + "WSTRING" : 0, #TODO
    + "DINT" : 4,
    + "UDINT" : 4,
    + "DWORD" : 4,
    + "LINT" : 4,
    + "ULINT" : 8,
    + "LWORD" : 8,
    + "REAL" : 4,
    + "LREAL" : 8,
    + }
    import re
    import targets
    @@ -1106,6 +1127,7 @@
    # prepare debug code
    debug_code = targets.code("plc_debug") % {
    + "buffer_size": reduce(lambda x, y: x + y, [DebugTypesSize.get(v["type"], 0) for v in self._VariablesList], 0),
    "programs_declarations":
    "\n".join(["extern %(type)s %(C_path)s;"%p for p in self._ProgramList]),
    "extern_variables_declarations":"\n".join([
    @@ -1245,6 +1267,8 @@
    try:
    # Do generate
    code = generator()
    + if code is None:
    + raise
    code_path = os.path.join(buildpath,filename)
    open(code_path, "w").write(code)
    # Insert this file as first file to be compiled at root plugin
    --- a/targets/plc_debug.c Thu Apr 09 15:27:45 2009 +0200
    +++ b/targets/plc_debug.c Fri Apr 10 07:53:42 2009 +0200
    @@ -14,8 +14,9 @@
    #include "POUS.h"
    /*for memcpy*/
    #include <string.h>
    +#include <stdio.h>
    -#define BUFFER_SIZE 1024
    +#define BUFFER_SIZE %(buffer_size)d
    #define MAX_SUBSCRIBTION %(subscription_table_count)d
    /* Atomically accessed variable for buffer state */
    @@ -158,13 +159,14 @@
    *type_name = __get_type_enum_name(my_var->type);
    /* get variable size*/
    USINT size = __get_type_enum_size(my_var->type);
    - /* compute next cursor positon*/
    + /* compute next cursor position*/
    buffer_cursor = buffer_cursor + size;
    if(old_cursor < debug_buffer + BUFFER_SIZE)
    {
    return old_cursor;
    }else{
    - return NULL;
    + printf("%%d > %%d\n", old_cursor - debug_buffer, BUFFER_SIZE);
    + return NULL;
    }
    }
    *idx = -1;