|
|
| F´ Version |
4.2.1 |
| Affected Component |
TlmPacketizer |
Problem Description
There is a potential issue with TlmPacketizer if it encounters the same channel ID. In TlmPacketizer::setPacketList, if it encounters the same channel ID in two different packets with different declared sizes, it will use the size of the last one it processed. There is a good chance this may not be the correct size for the previous channel ID (ex: channel ID 5 appears in packet A (declared size of 4 bytes) and packet B (declared size of 6 bytes).
The concern is the TlmGet_handler function uses the channel ID's size for its memcpy. If the size is incorrect, a buffer underflow or overflow condition will result.
Expected Behavior
Identical channel ID's should never occur, and if it does, it's probably due to a misconfiguration error. In any case, it would be good to know. When a channel is encountered for the second time in the packet loop, an assertion should be added to catch any declared size for a Channel ID that matches the already-stored one.
Note: The fix for PR 5118 does not fix this. Actually, this will trick the PR 5118 fix in thinking the size is correct when it is not.
Problem Description
There is a potential issue with TlmPacketizer if it encounters the same channel ID. In TlmPacketizer::setPacketList, if it encounters the same channel ID in two different packets with different declared sizes, it will use the size of the last one it processed. There is a good chance this may not be the correct size for the previous channel ID (ex: channel ID 5 appears in packet A (declared size of 4 bytes) and packet B (declared size of 6 bytes).
The concern is the TlmGet_handler function uses the channel ID's size for its memcpy. If the size is incorrect, a buffer underflow or overflow condition will result.
Expected Behavior
Identical channel ID's should never occur, and if it does, it's probably due to a misconfiguration error. In any case, it would be good to know. When a channel is encountered for the second time in the packet loop, an assertion should be added to catch any declared size for a Channel ID that matches the already-stored one.
Note: The fix for PR 5118 does not fix this. Actually, this will trick the PR 5118 fix in thinking the size is correct when it is not.