Buffer Overflow in the MEDITECH NPR Report Writer
For months - this bug ran undetected. One day the right conditions allowed it to crash the report.
In this case, /PROC[SU,6] was printed in a custom field:
xx.proc.6
DAT=FREE
LEN=40
VAL=/PROC[SU,6]
The vendor, who'd requested the extract, didn't need data beyond procedure 5 and requested that any remaining data reported in field xx.proc.6. The values in xx.proc.6 would likely be used for manual review if needed. The field only reported the value to a length of 40 characters.
As you know, MEDITECH variables on the Client Server & Magic platforms are limited to 255 characters. However, this code allowed more than 255 characters to be assigned to a variable (/PROC[SU,6]): /PROC[SU,6]_", "_@actual.op^/PROC[SU,6].
To resolve this overflow, the IF statement can be modified to stop processing when the length of the existing variable (/PROC[SU,6]) and field (@actual.op) will be greater than 255 characters when strung together:
IF{L(/PROC[SU,6]_", "_@actual.op)>255 0^/CONTINUE; ...
By implementing a condition based on the value /CONTINUE; the variable /PROC[SU,6] will never contain more than 255 characters. Now our DO{@PROC.NXT stops; this prevents inaccurate reporting if the next value for @actual.op is short enough to print in a field of 40 characters.
PROC.NXT
(/CONTINUE=1)&(@Next(actual.op.urn))
PROCEDURES
""^actual.op.urn,1^/CONTINUE,
DO{@PROC.NXT IF{actual.op.urn<6 @actual.op^/PROC[SU,actual.op.urn];
IF{L(/PROC[SU,6]_", "_@actual.op)>255 0^/CONTINUE;
/PROC[SU,6] /PROC[SU,6]_", "_@actual.op^/PROC[SU,6];
@actual.op^/PROC[SU,6]}}},
IF{/CONTINUE=0 (/PROC[SU,6]_", "_@actual.op):40TL^/PROC[SU,6]}
When you've inherited a report from another report writer, it is tempting to re-design and re-write the report from scratch. There's a saying in the programmer / developer world that goes something like this: if you can come back a year from now and review code you wrote today ... and not want to change anything, you're an expert.
Question: What could be more important than writing expert code in every report you work on?
Answer: Keeping your time focused on those reports that most 1) improve patient outcomes OR 2) contribute to the bottom line.
Have questions? Need answers? Join some of the smartest MEDITECH people in the industry at the Meditech Knowledge Exchange