[open-cobol-list] Issue with

[Robert Sherry]

Please consider the following code fragment from the file numeric.c:


int
cob_cmp_packed (cob_field *f, int n)
{
    int         sign;
    size_t          size;
    size_t          inc = 0;
    static int      lastval = 0;
    unsigned char       *p;
    unsigned char       val1[20];

    sign = COB_FIELD_HAVE_SIGN (f) ? cob_packed_get_sign (f) : 0;
    /* Field positive, value negative */
    if (sign >= 0 && n < 0) {
        return 1;
    }
    /* Field negative, value positive */
    if (sign < 0 && n >= 0) {
        return -1;
    }
    /* Both positive or both negative */
    p = f->data;
    for (size = 0; size < 20; size++) {
        if (size < 20 - f->size) {
            val1[size] = 0;
        } else {
            val1[size] = p[inc++];
        }
    }
    val1[19] &= 0xf0;
    if ((f->attr->digits % 2) == 0) {
        val1[size] &= 0x0f;
    }

Observe that upon exit from the for loop, the variable size will have a
value of 20. Therefore, the assignment statement:
        val1[size] &= 0x0f;
has problems because it references val1[20] and val1 has only 20 elements.

Bob Sherry