RE: Search for SELECT / FROM parameters in a CGI source from RPG

I agree, there are always checks and balances you need to put in, true.

In C when I would do this I would create a fixed character array to hold a
line, such as 130 chars, and if the length was greater than 128 I would do a
number of different things depending on what it was I was wanting to do with
what I was reading.  Sometimes I would just accept the 128 chars as a full
line, then start reading again, sometimes I would pop up a message box
stating buffer overflow and exit the app, etc...  Sometimes I would malloc
an additional 130 bytes if I actually needed to read lines that long.

RPG has Varying (or is that VarSize?) you can use and you should check to
see if it is greater than some huge amount (if %Length(LineBuffer) > 1000
... ).

Buffer maintenance can get quite complex, especially TCP buffers, and you
have to think of all the different things that can blow your buffer right
out of the water and take care of them *before* they happen.  I mean, how
many hot fixes has Microsoft put out for buffer overflow exploits in the
last year?

Regards,

Jim Langston

-----Original Message-----
From: James Rich [mailto:james@eaerich.com]

On Tue, 2 Apr 2002, Jim Langston wrote:

> Easiest way, read a single character at a time into a buffer until you hit
> an End of line character.  Then you have a line.  Create this in a
> subroutine once and be done with it.

The potential problem here is that there may not be an end of line
character reached before your buffer is filled.  In C this creates a
buffer overflow and in RPG an array index error.  A solution to this is to
allocate memory for a dynamic array as needed.  Then you just need to be
careful that you set a limit of some kind on how much memory your program
will allocate.  Your file may be very large and not contain any end of
line characters.  You could end up eating all the memory on the system.

James Rich
james@eaerich.com