Skip to content

Commit 9f3e35d

Browse files
authored
Add check for overflow in queue size calculation in RTOS compatibility layer. (#339)
* Add check for overflow in queue size calculation. * Update release data and version.
1 parent d9ffb0f commit 9f3e35d

File tree

1 file changed

+18
-0
lines changed

1 file changed

+18
-0
lines changed

utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@
3333
/* start flag, corrected stack */
3434
/* allocation size, */
3535
/* resulting in version 6.1.12 */
36+
/* 12-31-2023 Xiuwen Cai Modified comment(s), and */
37+
/* added check for overflow in */
38+
/* queue size calculation, */
39+
/* resulting in version 6.4.0 */
3640
/* */
3741
/**************************************************************************/
3842

@@ -1526,6 +1530,13 @@ QueueHandle_t xQueueCreate(UBaseType_t uxQueueLength, UBaseType_t uxItemSize)
15261530
}
15271531
#endif
15281532

1533+
if ((uxQueueLength > (SIZE_MAX / uxItemSize)) ||
1534+
(uxQueueLength > (ULONG_MAX / uxItemSize))) {
1535+
1536+
/* Integer overflow in queue size */
1537+
return NULL;
1538+
}
1539+
15291540
p_queue = txfr_malloc(sizeof(txfr_queue_t));
15301541
if(p_queue == NULL) {
15311542
return NULL;
@@ -2692,6 +2703,13 @@ QueueSetHandle_t xQueueCreateSet(const UBaseType_t uxEventQueueLength)
26922703
}
26932704
#endif
26942705

2706+
if ((uxEventQueueLength > (SIZE_MAX / sizeof(void *))) ||
2707+
(uxEventQueueLength > (ULONG_MAX / sizeof(void *)))) {
2708+
2709+
/* Integer overflow in queue size */
2710+
return NULL;
2711+
}
2712+
26952713
p_set = txfr_malloc(sizeof(txfr_queueset_t));
26962714
if(p_set == NULL) {
26972715
return NULL;

0 commit comments

Comments
 (0)