Skip to content

Commit e509826

Browse files
tony-josi-awstony-josi-aws
committed
Fix CI
1 parent 40aa8c8 commit e509826

File tree

8 files changed

+58
-43
lines changed

8 files changed

+58
-43
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ jobs:
129129
exclude-dirs: source/portable/NetworkInterface/STM32
130130

131131
formatting:
132-
runs-on: ubuntu-20.04
132+
runs-on: ubuntu-latest
133133
steps:
134134
- uses: actions/checkout@v4
135135
- name: Check formatting

‎History.txt‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
Documentation and download available at https://www.FreeRTOS.org/
22

33
Changes between FreeRTOS-plus-TCP V4.3.2 and V4.3.1 released June 03, 2025:
4-
+ It was possible to cause an out-of-bounds write when processing LLMNR
5-
or mDNS queries with very long DNS names. This issue only affects systems
6-
using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled.
4+
+ It was possible to cause an out-of-bounds write when processing LLMNR
5+
or mDNS queries with very long DNS names. This issue only affects systems
6+
using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled.
77
This issue has been fixed by adding checks to prevent out of bounds write.
8-
We would like to thank Paschal Amusuo (@AmPaschal),
9-
James C Davis (@davisjam), Taylor Le Lievre (@tlelievre26), and
10-
Aravind Kumar Machiry (@machiry) of Purdue University for collaborating
8+
We would like to thank Paschal Amusuo (@AmPaschal),
9+
James C Davis (@davisjam), Taylor Le Lievre (@tlelievre26), and
10+
Aravind Kumar Machiry (@machiry) of Purdue University for collaborating
1111
on this issue through the coordinated vulnerability disclosure process.
1212

1313
Changes between FreeRTOS-plus-TCP V4.3.1 and V4.3.0 released December 16, 2024:

‎source/portable/BufferManagement/BufferAllocation_1.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -429,7 +429,7 @@ UBaseType_t uxGetNumberOfFreeNetworkBuffers( void )
429429
NetworkBufferDescriptor_t * pxResizeNetworkBufferWithDescriptor( NetworkBufferDescriptor_t * pxNetworkBuffer,
430430
size_t xNewSizeBytes )
431431
{
432-
if( xNewSizeBytes <= ( ipconfigNETWORK_MTU + ipSIZE_OF_ETH_HEADER ) )
432+
if( xNewSizeBytes <= ( ipconfigNETWORK_MTU + ipSIZE_OF_ETH_HEADER ) )
433433
{
434434
/* In BufferAllocation_1.c all network buffer are allocated with a
435435
* maximum size of 'ipTOTAL_ETHERNET_FRAME_SIZE'.No need to resize the

‎test/cbmc/patches/FreeRTOSIPConfig.h‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,9 @@
5555
/* If the network card/driver includes checksum offloading then set
5656
* ipconfigDRIVER_INCLUDED_RX_IP_CHECKSUM to 1 to prevent the software
5757
* stack repeating the checksum calculations. */
58-
#define ipconfigDRIVER_INCLUDED_RX_IP_CHECKSUM 1
58+
#ifndef ipconfigDRIVER_INCLUDED_RX_IP_CHECKSUM
59+
#define ipconfigDRIVER_INCLUDED_RX_IP_CHECKSUM 1
60+
#endif
5961

6062
/* Several API's will block until the result is known, or the action has been
6163
* performed, for example FreeRTOS_send() and FreeRTOS_recv(). The timeouts can be
@@ -121,9 +123,13 @@
121123
* set to 1 if a valid configuration cannot be obtained from a DHCP server for any
122124
* reason. The static configuration used is that passed into the stack by the
123125
* FreeRTOS_IPInit() function call. */
124-
#define ipconfigUSE_DHCP 1
126+
#ifndef ipconfigUSE_DHCP
127+
#define ipconfigUSE_DHCP 1
128+
#endif
125129

126-
#define ipconfigDHCP_REGISTER_HOSTNAME 1
130+
#ifndef ipconfigDHCP_REGISTER_HOSTNAME
131+
#define ipconfigDHCP_REGISTER_HOSTNAME 1
132+
#endif
127133

128134
#define ipconfigDHCP_USES_UNICAST 1
129135

@@ -230,11 +236,15 @@
230236
* lower value can save RAM, depending on the buffer management scheme used. If
231237
* ipconfigCAN_FRAGMENT_OUTGOING_PACKETS is 1 then (ipconfigNETWORK_MTU - 28) must
232238
* be divisible by 8. */
233-
#define ipconfigNETWORK_MTU 1500U
239+
#ifndef ipconfigNETWORK_MTU
240+
#define ipconfigNETWORK_MTU 1500U
241+
#endif
234242

235243
/* Set ipconfigUSE_DNS to 1 to include a basic DNS client/resolver. DNS is used
236244
* through the FreeRTOS_gethostbyname() API function. */
237-
#define ipconfigUSE_DNS 1
245+
#ifndef ipconfigUSE_DNS
246+
#define ipconfigUSE_DNS 1
247+
#endif
238248

239249
/* If ipconfigREPLY_TO_INCOMING_PINGS is set to 1 then the IP stack will
240250
* generate replies to incoming ICMP echo (ping) requests. */

‎test/cbmc/proofs/DNS_ParseDNSReply/Configurations.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"ENTRY": "DNS_ParseDNSReply",
3-
"TEST_MAX_TEST_UNWIND_LOOP": 8,
3+
"TEST_MAX_TEST_UNWIND_LOOP": 6,
44
"TEST_MIN_TEST_DNS_HEADER": 12,
55
"TEST_MIN_IPV4_UDP_PACKET_SIZE": 42,
66
"TEST_MIN_IPV6_UDP_PACKET_SIZE": 62,

‎test/cbmc/proofs/DNS_ParseDNSReply/DNS_ParseDNSReply_harness.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,13 +63,15 @@ NetworkBufferDescriptor_t * pxUDPPayloadBuffer_to_NetworkBuffer( const void * pv
6363
uint32_t ulChar2u32( const uint8_t * pucPtr )
6464
{
6565
uint32_t ret;
66+
6667
__CPROVER_assert( __CPROVER_r_ok( pucPtr, 4 ), "must be 4 bytes legal address to read" );
6768
return ret;
6869
}
6970

7071
uint16_t usChar2u16( const uint8_t * pucPtr )
7172
{
7273
uint16_t ret;
74+
7375
__CPROVER_assert( __CPROVER_r_ok( pucPtr, 2 ), "must be 2 bytes legal address to read" );
7476
return ret;
7577
}

‎test/cbmc/proofs/parsing/ProcessReceivedTCPPacket/ProcessReceivedTCPPacket_harness.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,7 @@ void harness()
178178
{
179179
NetworkBufferDescriptor_t * pxNetworkBuffer;
180180
size_t tcpPacketSize;
181+
181182
__CPROVER_assume( tcpPacketSize >= ( ipSIZE_OF_ETH_HEADER + ipSIZE_OF_IPv4_HEADER + sizeof( TCPHeader_t ) ) );
182183

183184
pxNetworkBuffer = pxGetNetworkBufferWithDescriptor( tcpPacketSize, 0 );

‎test/unit-test/FreeRTOS_DNS_Parser/FreeRTOS_DNS_Parser_utest.c‎

Lines changed: 31 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -2999,51 +2999,52 @@ void test_DNS_ParseDNSReply_answer_lmmnr_reply_fixed_buffer_full_content( void )
29992999
dns_header->usFlags = dnsDNS_PORT;
30003000

30013001
/* First 5 queries have maximum length. */
3002+
30023003
/* DNS name field format requirements:
30033004
* - First two bits must be zero to indicate real length
30043005
* - Maximum length of a single label is 63 bytes (due to first two bits requirement)
30053006
* - Total DNS name is set to 254 bytes to match ipconfigDNS_CACHE_NAME_LENGTH
3006-
*
3007+
*
30073008
* Format breakdown:
30083009
* [label1].[label2].[label3].[label4][\0]
30093010
* where:
30103011
* - label1, label2, label3: 63 bytes each
30113012
* - label4: 61 bytes
30123013
* - Total: 63 + 63 + 63 + 61 + 4 (length) + 1 (null terminator) = 255 bytes
30133014
*/
3014-
for( i=0; i<5; i++ )
3015+
for( i = 0; i < 5; i++ )
30153016
{
30163017
pucUDPPayloadBuffer[ beg ] = 63;
30173018
beg++;
30183019
strcpy( pucUDPPayloadBuffer + beg,
3019-
"FreeRTOSFreeRTOSFree" // 20
3020-
"FreeRTOSFreeRTOSFree" // 40
3021-
"FreeRTOSFreeRTOSFree" // 60
3022-
"Fre" ); // 63
3020+
"FreeRTOSFreeRTOSFree" /* 20 */
3021+
"FreeRTOSFreeRTOSFree" /* 40 */
3022+
"FreeRTOSFreeRTOSFree" /* 60 */
3023+
"Fre" ); /* 63 */
30233024
beg += 63;
30243025
pucUDPPayloadBuffer[ beg ] = 63;
30253026
beg++;
30263027
strcpy( pucUDPPayloadBuffer + beg,
3027-
"FreeRTOSFreeRTOSFree" // 20
3028-
"FreeRTOSFreeRTOSFree" // 40
3029-
"FreeRTOSFreeRTOSFree" // 60
3030-
"Fre" ); // 63
3028+
"FreeRTOSFreeRTOSFree" /* 20 */
3029+
"FreeRTOSFreeRTOSFree" /* 40 */
3030+
"FreeRTOSFreeRTOSFree" /* 60 */
3031+
"Fre" ); /* 63 */
30313032
beg += 63;
30323033
pucUDPPayloadBuffer[ beg ] = 63;
30333034
beg++;
30343035
strcpy( pucUDPPayloadBuffer + beg,
3035-
"FreeRTOSFreeRTOSFree" // 20
3036-
"FreeRTOSFreeRTOSFree" // 40
3037-
"FreeRTOSFreeRTOSFree" // 60
3038-
"Fre" ); // 63
3036+
"FreeRTOSFreeRTOSFree" /* 20 */
3037+
"FreeRTOSFreeRTOSFree" /* 40 */
3038+
"FreeRTOSFreeRTOSFree" /* 60 */
3039+
"Fre" ); /* 63 */
30393040
beg += 63;
30403041
pucUDPPayloadBuffer[ beg ] = 61;
30413042
beg++;
30423043
strcpy( pucUDPPayloadBuffer + beg,
3043-
"FreeRTOSFreeRTOSFree" // 20
3044-
"FreeRTOSFreeRTOSFree" // 40
3045-
"FreeRTOSFreeRTOSFree" // 60
3046-
"F" ); // 61
3044+
"FreeRTOSFreeRTOSFree" /* 20 */
3045+
"FreeRTOSFreeRTOSFree" /* 40 */
3046+
"FreeRTOSFreeRTOSFree" /* 60 */
3047+
"F" ); /* 61 */
30473048
beg += 61;
30483049
pucUDPPayloadBuffer[ beg++ ] = '\0';
30493050

@@ -3055,12 +3056,13 @@ void test_DNS_ParseDNSReply_answer_lmmnr_reply_fixed_buffer_full_content( void )
30553056
* - Header: 12 bytes
30563057
* - Query section: (255 + 4) * 5 bytes = 1295 bytes
30573058
* - Total used: 1307 bytes
3058-
*
3059+
*
30593060
* Available space in UDP payload:
30603061
* - Total UDP payload: 1472 bytes
30613062
* - Used space: 1307 bytes
30623063
* - Remaining space: 165 bytes
30633064
*/
3065+
30643066
/* Last query to fill the remaining 165 bytes. Reserve 4 bytes for type and class fields.
30653067
*
30663068
* Format breakdown:
@@ -3072,24 +3074,24 @@ void test_DNS_ParseDNSReply_answer_lmmnr_reply_fixed_buffer_full_content( void )
30723074
pucUDPPayloadBuffer[ beg ] = 63;
30733075
beg++;
30743076
strcpy( pucUDPPayloadBuffer + beg,
3075-
"FreeRTOSFreeRTOSFree" // 20
3076-
"FreeRTOSFreeRTOSFree" // 40
3077-
"FreeRTOSFreeRTOSFree" // 60
3078-
"Fre" ); // 63
3077+
"FreeRTOSFreeRTOSFree" /* 20 */
3078+
"FreeRTOSFreeRTOSFree" /* 40 */
3079+
"FreeRTOSFreeRTOSFree" /* 60 */
3080+
"Fre" ); /* 63 */
30793081
beg += 63;
30803082
pucUDPPayloadBuffer[ beg ] = 63;
30813083
beg++;
30823084
strcpy( pucUDPPayloadBuffer + beg,
3083-
"FreeRTOSFreeRTOSFree" // 20
3084-
"FreeRTOSFreeRTOSFree" // 40
3085-
"FreeRTOSFreeRTOSFree" // 60
3086-
"Fre" ); // 63
3085+
"FreeRTOSFreeRTOSFree" /* 20 */
3086+
"FreeRTOSFreeRTOSFree" /* 40 */
3087+
"FreeRTOSFreeRTOSFree" /* 60 */
3088+
"Fre" ); /* 63 */
30873089
beg += 63;
30883090
pucUDPPayloadBuffer[ beg ] = 31;
30893091
beg++;
30903092
strcpy( pucUDPPayloadBuffer + beg,
3091-
"FreeRTOSFreeRTOSFree" // 20
3092-
"FreeRTOSFre" ); // 31
3093+
"FreeRTOSFreeRTOSFree" /* 20 */
3094+
"FreeRTOSFre" ); /* 31 */
30933095
beg += 31;
30943096
pucUDPPayloadBuffer[ beg++ ] = '\0';
30953097

0 commit comments

Comments
 (0)