Perry E. Metzger ba514d6feb SCP: Fix expression evaluation wrong buffer parsed after environment lookup ...

This bug report was generated by Codex on Perry Metzger's codebase.

Summary

In scp.c, SCP expression evaluation can parse the wrong string after
_sim_get_env_special() returns a value.

The failure occurs when:
      - the expression element is not a register name
      - _sim_get_env_special() finds a numeric value
      - the returned pointer is not the local string buffer passed by
        the caller, but some other backing storage, such as a host
        environment string

In that case, sim_eval_expression() incorrectly parses string instead of
the pointer returned by _sim_get_env_special().

User-visible effect

A numeric expression that refers to a host environment variable can evaluate
incorrectly.

Example:

SIMH_TEST_EXPR_VALUE=41
expression: SIMH_TEST_EXPR_VALUE + 1
expected: 42
actual:   1

The + 1 still works, but the left-hand variable is parsed from the wrong
buffer, so it contributes 0.

2026-04-21 06:50:21 -10:00

718 KiB

Raw Blame History

View Raw