KB_110097 - Vasco

KB 110097
Null termination problem of aat_ascii buffers in C/C++
implementations of the VACMAN Controller.
Creation date: 30/09/2011 Last Review: 06/02/2012 Revision number: 2
Document type: Documentation Security status: EXTERNAL
Summary
Based on the VACMAN Controller Programmer’s Guide all the aat_ascii string buffers
must be null terminated and all aat_ascii string buffers returned by the VACMAN
Controller will be null-terminated. But the sw_out_type output parameter returned by
a VACMAN Controller function is not null terminated.
Details
The VACMAN Controller Programmer’s Guide clearly states that aat_ascii String Buffers
must be null terminated:
3.1.3 Null-Termination of aat_ascii String Buffers
To be handled correctly, all the aat_ascii string buffers passed in the
parameters of a function must be null-terminated. This null character \0 allows the
VACMAN Controller to determine the aat_ascii string length.
CAUTION
aat_ascii string buffers which are not null-terminated may cause
your system to crash.
In addition, all the aat_ascii string buffers filled and returned by a function will
be null-terminated.
aat_byte buffers passed in the parameters of a function must not be nullterminated.
However the sw_out_type parameter of type aat_ascii, generated by the
AAL2DPXGetToken function is not null terminated.
The sw_out_type of the VACMAN Controller returns a fixed length of 5 digits and the
correct implementation would be to pass in at least a buffer sw_out_type of 6
characters (5+1)
Applies to: VACMAN Controller
KB 110097 – 6/02/2012 16:05
© 2012 VASCO Data Security. All rights reserved.
Page 1 of 2

Since the length of sw_out_type is always a fixed length of 5 digits, in earlier versions
of the VACMAN Controller the null terminator was not required.
Changing this behavior now and forcing the sixth character to be a null character could
cause issues in upgrade scenarios from older versions to recent versions of the
VACMAN Controller.
A workaround can be to pass in a sw_out_type buffer of 6 chars which has been
initialized to 0 before the function call:
memset (sw_out_type, 0, 6);
Applies to: VACMAN Controller
KB 110097 – 6/02/2012 16:05
© 2012 VASCO Data Security. All rights reserved.
Page 2 of 2