Merge branch 'bmk/megaco/flex_buffer_overrun_while_scanning_prop_parms/OTP-10998/r16' into maint-r16

* bmk/megaco/flex_buffer_overrun_while_scanning_prop_parms/OTP-10998/r16:
  [megaco] Appup cleanup
  [megaco] Retroactive version bump
  [megaco] Used wrong downgrade tag for (flex) handler
  [megaco] Fixrd appup sub-test suite
  [megaco] Debug printouts in megaco test server
  [megaco] Internal test server not handling failing cases
  [megaco] Fix merge
  [megaco] Misc codec tickets test case fixes
  [megaco] Misc fixes of the (internal) megaco test server
  Changed name of test case functions (from seq12263 to otp10998)
  Assign correct version and updated release notes accordingly.
  Removed comments
  Ensure of incorrect number of terms when scanning property groups
  Uncommented test cases
  Add new messages
  Calculation of term_spec size (initial and next) changed
  Minor test case rework
  Test case cleanup
  Add rule for test beam'es
  Preliminary test case updates

1 files changed, 23 insertions, 8 deletions

diff --git a/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src b/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src
index 3914a81b8c..90d5c2aae6 100644
--- a/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src
+++ b/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src
@@ -1,8 +1,8 @@
   /*
    * %CopyrightBegin%
-   *
+   * 
    * Copyright Ericsson AB 2001-2013. All Rights Reserved.
-   *
+   * 
    * The contents of this file are subject to the Erlang Public License,
    * Version 1.1, (the "License"); you may not use this file except in
    * compliance with the License. You should have received a copy of the
@@ -95,6 +95,13 @@ typedef struct {
     int             token_counter;
 } MfsErlDrvData;
 
+/* IBL = In Buffer Length - the raw (un-decoded) message buffer length */
+#define TERM_SPEC_SIZE_INITIAL(IBL) (1024 + 2*(IBL))
+
+/* CTSS = Current term spec size - the current term spec length */
+/* S    = Size - how many positions we need */
+#define TERM_SPEC_SIZE_NEXT(CTSS,S)   ((CTSS) + 1024 + (S))
+
 #if !defined(MEGACO_REENTRANT_FLEX_SCANNER)
 static MfsErlDrvData mfs_drv_data;
 #endif
@@ -737,7 +744,7 @@ v                                       LOAD_TOKEN(mfs_VersionToken);
 #endif
 
 
-/* #define MFS_DEBUG true */    /* temporary */
+// #define MFS_DEBUG true 
 #if defined(MFS_DEBUG)
 #  define DBG( proto ) printf proto
 #  define DBG_BUF(func, bufName, buf, bufSz) mfs_dbg_buf_print(func, bufName, buf, bufSz)
@@ -842,15 +849,20 @@ static void mfs_ensure_term_spec(MfsErlDrvData* dataP, int size)
 	  "\n   term_spec_size:  %d\n", 
 	  dataP->term_spec_index, dataP->term_spec_size) );
 
-    dataP->term_spec_size = (dataP->term_spec_size * 2) + size;
+    dataP->term_spec_size = TERM_SPEC_SIZE_NEXT(dataP->term_spec_size, size);
 
     DBG( ("mfs_ensure_term_spec -> "
-	  "term_spec is at 0x%X, new term_spec_size is %d\n", 
-	  (unsigned int) dataP->term_spec, dataP->term_spec_size) );
+	  "term_spec is at 0x%X, new term_spec_size is %d (%lu)\n", 
+	  (unsigned int) dataP->term_spec, 
+	  dataP->term_spec_size, 
+	  dataP->term_spec_size * sizeof(ErlDrvTermData)) );
 
     tmp = REALLOC(dataP->term_spec, 
                   dataP->term_spec_size * sizeof(ErlDrvTermData));
 
+    DBG( ("mfs_ensure_term_spec -> "
+	  "realloc result: 0x%X\n", (unsigned int) tmp) );
+
     if (tmp == NULL) {
       /*
        * Ouch, we did'nt get any new memory.
@@ -942,6 +954,9 @@ static void mfs_octet_load_token(ErlDrvTermData TokenTag, int is_empty)
 
   ASSIGN_TERM_SPEC(dataP, ERL_DRV_TUPLE);
   ASSIGN_TERM_SPEC(dataP, 3);
+
+  DBG( ("mfs_octet_load_token -> done\n") );
+
 }
 
 #if defined(MEGACO_REENTRANT_FLEX_SCANNER)
@@ -1241,7 +1256,7 @@ static void mfs_load_property_groups(MfsErlDrvData* dataP)
     } // if ((yytext[i] != SP)...
   } // while ...      
       
-  mfs_ensure_term_spec(dataP, 4); // 2 + 2 just in case
+  mfs_ensure_term_spec(dataP, 6); // 3 + 3 just in case
 
   /* Make sure we actually have some groups */
 
@@ -1727,7 +1742,7 @@ static ErlDrvSSizeT mfs_control(ErlDrvData          handle,
   dataP->text_buf = tmp;
   dataP->text_ptr = tmp;
 
-  dataP->term_spec_size = 1000 + buf_len;       /* OTP-4237 */
+  dataP->term_spec_size = TERM_SPEC_SIZE_INITIAL(buf_len); 
 
   DBG( ("mfs_control -> allocate term-spec buffer: "
 	"\n   term_spec_size: %d\n", dataP->term_spec_size) );