Programming IMX10 using HCB broken since 1.4.18

[hrak]

It is my understanding that there is someone on this forum who is in some way connected to the development of the firmware of the home control box, so i thought i'd share it here.

Since firmware version 1.4.18-993 i am having trouble programming a IMX10. Once i hit the program button in the web interface a popup shows up telling me to click start, like this:



Once i click start the window changes to this:



And then Firefox shows a download dialog like this:



It seems to me the perl script hdrv_a10x10_program_sendbuffer.pl fails and makes Firefox show a download dialog. The HTTP headers seem to confirm this is a script failing:

Code: Select all

GET /config/hdrv_a10x10_program_sendbuffer.pl?sendstring=C04C04%20C04C04%20DEL00%20CBGTCBGT%20CBGTCBGT%20DEL00%20CAUFCAUF%20CAUFCAUF%20DEL00%20CALNCALN%20CALNCALN%20DEL00%20CALFCALF%20CALFCALF%20DEL00%20CSONCSON%20CSONCSON%20DEL00%20A02A02%20A02A02%20DEL00%20AONAON%20AONAON%20DEL00%20A03A03%20A03A03%20DEL00%20AONAON%20AONAON%20DEL00%20A04A04%20A04A04%20DEL00%20AONAON%20AONAON%20DEL00%20DEL16&home=1 HTTP/1.1
Host: hcb.XXX.XXX.nl
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:6.0) Gecko/20100101 Firefox/6.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection: keep-alive
Referer: http://hcb.XXX.XXX.nl/config/hdrv_a10x10_2_program.pl?selDeviceType=IMX10
Cookie: cstree=3; cotree=10; __utma=226870174.2971170578415259600.1242628845.1313059250.1313484803.35; __utmz=226870174.1304353009.28.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
Authorization: Basic blablabauthstring

HTTP/0.9 200 OK

I tried in Windows with Internet Explorer, but the results are pretty much the same.
Programming SAIX/DAIX/ZAX seems to work fine (no download dialogs)
I can provide additional info if needed!

Since i don't have a PMIX35 my hands are kind of tied right now

[Bwired]

Why dont you send a mail to the support site HCB?

[Henk]

The IMX10 is a complex module to program, so many combinations are possible and may be some combinations will not be corrected programmed by the HCB.

There is currently no maintenance release of the HCB planned.

So how to work around …and getting your IMX10 working:

Get from the IMX10 documentation all the required X10 commands you want and write them down including the way the IMX10 should react .. like the number of flashes of the status led.

Connect the IMX10 on line and in programming mode close to the HCB and go to the HCB test screen and enter the required X10 commands manually one by one and checking the flashes …

An alternative is to make a HCB macro with all the X10 commands line by line and executing this macro in the HCB test screen. I assume all the required X10 commands can be issued by the HCB THEN statements.

Henk

[hrak]

Why dont you send a mail to the support site HCB?

Well, since Home Automation stopped working on the HCB i don't really know where to turn to
What is the current official support channel for the HCB?

Anyway, i have done some digging of my own, and i think i have an idea where the problem lies:

hdrv_a10x10_program_sendbuffer.pl sends the string 'sendstring' to the a10x10 driver through the boxtalk interface.
Boxtalk server talks a10x10 through /HCBv2/sbin/hdrv_a10x10
the hdrv_a10x10 crashes when programming a IMX10

Looking at the 'sendstring' which gets passed along to the a10x10 driver when programming my IMX10, we see the following:

Code: Select all

C04C04 C04C04 DEL00 CBGTCBGT CBGTCBGT DEL00 CAUFCAUF CAUFCAUF DEL00 CALNCALN CALNCALN DEL00 CALFCALF CALFCALF DEL00 CSONCSON CSONCSON DEL00 A02A02 A02A02 DEL00 AONAON AONAON DEL00 A03A03 A03A03 DEL00 AONAON AONAON DEL00 A04A04 A04A04 DEL00 AONAON AONAON DEL00 DEL16

The string length of this 'sendstring' is 265, which is just a bit over 256. Something tells me the hdrv_a10x10 has an internal buffer for the sendstring of size 256, and the programming sequence for the IMX10 exceeds this limit, thus resulting in a buffer overflow (and a segmentation fault) which crashes the driver.

This is all a hunch since i don't have the source to hdrv_a10x10, but since SAIX, DAIX and ZAX modules program fine(since they have shorter 'sendstring's), and the string length is so close to 256, it kind of makes sense