{"action":"created","issue":{"url":"https://api.github.com/repos/epics-base/pvDataCPP/issues/20","labels_url":"https://api.github.com/repos/epics-base/pvDataCPP/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/epics-base/pvDataCPP/issues/20/comments","events_url":"https://api.github.com/repos/epics-base/pvDataCPP/issues/20/events","html_url":"https://github.com/epics-base/pvDataCPP/issues/20","id":124137725,"number":20,"title":"Buffer overflows during serialization","user":{"login":"mdavidsaver","id":4429215,"avatar_url":"https://avatars.githubusercontent.com/u/4429215?v=3","gravatar_id":"","url":"https://api.github.com/users/mdavidsaver","html_url":"https://github.com/mdavidsaver","followers_url":"https://api.github.com/users/mdavidsaver/followers","following_url":"https://api.github.com/users/mdavidsaver/following{/other_user}","gists_url":"https://api.github.com/users/mdavidsaver/gists{/gist_id}","starred_url":"https://api.github.com/users/mdavidsaver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdavidsaver/subscriptions","organizations_url":"https://api.github.com/users/mdavidsaver/orgs","repos_url":"https://api.github.com/users/mdavidsaver/repos","events_url":"https://api.github.com/users/mdavidsaver/events{/privacy}","received_events_url":"https://api.github.com/users/mdavidsaver/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/epics-base/pvDataCPP/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"mdavidsaver","id":4429215,"avatar_url":"https://avatars.githubusercontent.com/u/4429215?v=3","gravatar_id":"","url":"https://api.github.com/users/mdavidsaver","html_url":"https://github.com/mdavidsaver","followers_url":"https://api.github.com/users/mdavidsaver/followers","following_url":"https://api.github.com/users/mdavidsaver/following{/other_user}","gists_url":"https://api.github.com/users/mdavidsaver/gists{/gist_id}","starred_url":"https://api.github.com/users/mdavidsaver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdavidsaver/subscriptions","organizations_url":"https://api.github.com/users/mdavidsaver/orgs","repos_url":"https://api.github.com/users/mdavidsaver/repos","events_url":"https://api.github.com/users/mdavidsaver/events{/privacy}","received_events_url":"https://api.github.com/users/mdavidsaver/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-12-28T22:52:32Z","updated_at":"2015-12-30T16:55:55Z","closed_at":null,"body":"Today @shengb  and I were troubleshooting a crash of the masarService.  The crash appeared first in a memcpy() in DefaultPVArray<T>::serialize() due to an obviously corrupt 'space_for'.  Further investigation showed that the byteBuffer involved had _position >> _limit so that getRemaining() returned a negative value cast to size_t.  This was happening in a PVA send thread.\r\n\r\nWe changed PVUnionArray::serialize() to flush after serializing each element.  This avoids a crash, and suggests to me that there are some missing ensureBuffer() calls.  I see immediately that DefaultPVArray<T>::serialize() calls SerializeHelper::writeSize() with no check to see that space is available.  There may be others.\r\n"},"comment":{"url":"https://api.github.com/repos/epics-base/pvDataCPP/issues/comments/168033504","html_url":"https://github.com/epics-base/pvDataCPP/issues/20#issuecomment-168033504","issue_url":"https://api.github.com/repos/epics-base/pvDataCPP/issues/20","id":168033504,"user":{"login":"mdavidsaver","id":4429215,"avatar_url":"https://avatars.githubusercontent.com/u/4429215?v=3","gravatar_id":"","url":"https://api.github.com/users/mdavidsaver","html_url":"https://github.com/mdavidsaver","followers_url":"https://api.github.com/users/mdavidsaver/followers","following_url":"https://api.github.com/users/mdavidsaver/following{/other_user}","gists_url":"https://api.github.com/users/mdavidsaver/gists{/gist_id}","starred_url":"https://api.github.com/users/mdavidsaver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdavidsaver/subscriptions","organizations_url":"https://api.github.com/users/mdavidsaver/orgs","repos_url":"https://api.github.com/users/mdavidsaver/repos","events_url":"https://api.github.com/users/mdavidsaver/events{/privacy}","received_events_url":"https://api.github.com/users/mdavidsaver/received_events","type":"User","site_admin":false},"created_at":"2015-12-30T16:55:55Z","updated_at":"2015-12-30T16:55:55Z","body":"FYI this effects all releases of pvDataCPP since unions were introduced (3.0.2 -> 5.0.0).  I would proposed that this bug is serious enough to make patch release soon (say in the next month)."}}