Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HS uses the CFE_SB_Buffer_t type incorrectly #112

Open
2 tasks done
jphickey opened this issue Sep 8, 2023 · 0 comments
Open
2 tasks done

HS uses the CFE_SB_Buffer_t type incorrectly #112

jphickey opened this issue Sep 8, 2023 · 0 comments

Comments

@jphickey
Copy link
Contributor

jphickey commented Sep 8, 2023

Checklist (Please check before submitting)

  • I reviewed the Contributing Guide.
  • I performed a cursory search to see if the bug report is relevant, not redundant, nor in conflict with other tickets.

Describe the bug
The CFE_SB_Buffer_t is a special type, referring to message buffers that are allocated from the SB message pool. The only real source of these objects is the function CFE_SB_AllocateMessageBuffer().

Although this type is defined in a public header for API reasons, it should never be instantiated by apps, and doing so is unsafe. Passing such an object (a "CFE_SB_Buffer_t" instance that didn't actually come from CFE_SB_AllocateMessageBuffer()) to a function like CFE_SB_TransmitBuffer() will likely corrupt the memory pool - it is akin to calling free() on a block that didn't come from malloc().

Code snips

CFE_SB_Buffer_t Buffer; /**< \brief Message Buffer for alignment */

System observed on:

  • Hardware
  • OS: [e.g. Linux 4.4]
  • Versions [e.g. cFE 6.6, OSAL 4.2, PSP 1.3 for mcp750, any related apps]

Additional context
It appears the intent here was to get some alignment in the table entries. But alignment can be achieved by simply using void* and/or long long. Using CFE_SB_Buffer_t in this context has unsafe implications.

Reporter Info
Joseph Hickey, Vantage Systems, Inc.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant