Embedded/threadx
1
0
Fork 0
mirror of https://github.com/azure-rtos/threadx synced 2025-01-30 08:02:57 +08:00
Code Issues Releases Wiki Activity

Add check for overflow in queue size calculation.

Browse Source
This commit is contained in:
Xiuwen Cai 2023-12-08 02:37:24 +00:00
parent 776ea213ce
commit 83a50f9feb
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c
View File

@ -33,6 +33,10 @@
/* start flag, corrected stack */
/* allocation size, */
/* resulting in version 6.1.12 */
/* xx-xx-xxxx Xiuwen Cai Modified comment(s), and */
/* added check for overflow in */
/* queue size calculation, */
/* resulting in version 6.x */
/* */
/**************************************************************************/
@ -1526,6 +1530,13 @@ QueueHandle_t xQueueCreate(UBaseType_t uxQueueLength, UBaseType_t uxItemSize)
}
#endif
if ((uxQueueLength > (SIZE_MAX / uxItemSize)) ||
(uxQueueLength > (ULONG_MAX / uxItemSize))) {
/* Integer overflow in queue size */
return NULL;
}
p_queue = txfr_malloc(sizeof(txfr_queue_t));
if(p_queue == NULL) {
return NULL;
@ -2692,6 +2703,13 @@ QueueSetHandle_t xQueueCreateSet(const UBaseType_t uxEventQueueLength)
}
#endif
if ((uxEventQueueLength > (SIZE_MAX / sizeof(void *))) ||
(uxEventQueueLength > (ULONG_MAX / sizeof(void *)))) {
/* Integer overflow in queue size */
return NULL;
}
p_set = txfr_malloc(sizeof(txfr_queueset_t));
if(p_set == NULL) {
return NULL;