RADE

Problematic

The callback mechanism is the way CAA V5 implements publish/subscribe between objects. This mechanism is implemented with method pointers. The user has to specify the type of the method by a cast of the address of the method pointer. If the cast does not meet the method signature (incorrect number of arguments), heap overwriting will happen at runtime, which is a serious problem leading to memory corruption.

4 ways of setting a callback are checked by the tool :

• AddAnalyseNotificationCB [2]
  the third argument must be a method pointer. The implementation of this method pointer must have 3 arguments.

  AddAnalyseNotificationCB(__Select_Mechanism, __Select_Mechanism-> GetComboSelectNotification(), (CATCommandMethod) &DNBDeviceMoveScheduleDlg::OnMechanismSelectionChange, NULL);

• AddCallback [1]
  the third argument must be a method pointer. The implementation of this method pointer must have 5 arguments.
• AddTransition [3]
  the third argument must be a method pointer. The implementation of this method pointer must have 1 argument.
• Filter [3]
  the first argument must be a method pointer. The implementation of this method pointer must have 2 arguments.

Checks

Principle

For each occurrence of a callback set (each occurrence of AddAnalyseNotificationCB, AddCallback, AddTransition or Filter), the tool looks if the corresponding argument (ex : 3rd for AddAnalyseNotificationCB) is a method pointer. If it is, CSC looks in its symbol table for the implementation of this method. If the corresponding implementation does not have the good number of arguments (ex : 3 for AddAnalyseNotificationCB), the tool reports a BCBA error.

BCBA

BCBA stands for Bad CallBAck.

An error of type BCBA is reported when :

• a callback is set with a bad signature for callback method

Example BCBA-1

Let's assume that the signature of the method OnMechanismSelectionChange of the class CATDeviceMoveScheduleDlg is :

class CATDeviceMoveScheduleDlg
{
  ...
  void OnMechanismSelectionChange( CATCommand * iFromClient, CATNotification * iEvtDat);
  ...
}

The following code will report a BCBA error :

CATDeviceMoveDcheduleDlg.cpp
...
AddAnalyseNotificationCB(_selection, _selection-> GetComboSelectNotification(), 
  (CATCommandMethod) &CATDeviceMoveScheduleDlg::OnMechanismSelectionChange, NULL);
...

To correct the error, modify the signature of  CATDeviceMoveScheduleDlg::OnMechanismSelectionChange like the following :

class CATDeviceMoveScheduleDlg
{
  ...
  void OnMechanismSelectionChange( 	CATCommand * iFromClient,
				CATNotification * iEvtDat,
				CATCommandClientData iUsefulData);
  ...
}

Relative sections in setting files

No external parameter is taken into account for this check.

In Short

C++ Source Checker can easily and quickly point bad usage of callbacks, preventing a very laborious runtime debug, preventing runtime abort and waste of time for the user.

[Top]

References

History

Copyright © 2000, Dassault Systèmes. All rights reserved.