You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I performed a cursory search to see if the bug report is relevant, not redundant, nor in conflict with other tickets.
Describe the bug
The CFE_SB_Buffer_t is a special type, referring to message buffers that are allocated from the SB message pool. The only real source of these objects is the function CFE_SB_AllocateMessageBuffer().
Although this type is defined in a public header for API reasons, it should never be instantiated by apps, and doing so is unsafe. Passing such an object (a "CFE_SB_Buffer_t" instance that didn't actually come from CFE_SB_AllocateMessageBuffer()) to a function like CFE_SB_TransmitBuffer() will likely corrupt the memory pool - it is akin to calling free() on a block that didn't come from malloc().
CFE_SB_Buffer_tBuffer; /**< \brief Message Buffer for alignment */
System observed on:
Hardware
OS: [e.g. Linux 4.4]
Versions [e.g. cFE 6.6, OSAL 4.2, PSP 1.3 for mcp750, any related apps]
Additional context
It appears the intent here was to get some alignment in the table entries. But alignment can be achieved by simply using void* and/or long long. Using CFE_SB_Buffer_t in this context has unsafe implications.
Reporter Info
Joseph Hickey, Vantage Systems, Inc.
The text was updated successfully, but these errors were encountered:
Checklist (Please check before submitting)
Describe the bug
The
CFE_SB_Buffer_t
is a special type, referring to message buffers that are allocated from the SB message pool. The only real source of these objects is the functionCFE_SB_AllocateMessageBuffer()
.Although this type is defined in a public header for API reasons, it should never be instantiated by apps, and doing so is unsafe. Passing such an object (a "CFE_SB_Buffer_t" instance that didn't actually come from
CFE_SB_AllocateMessageBuffer()
) to a function likeCFE_SB_TransmitBuffer()
will likely corrupt the memory pool - it is akin to callingfree()
on a block that didn't come frommalloc()
.Code snips
HS/config/default_hs_tblstruct.h
Line 93 in 4d38d46
System observed on:
Additional context
It appears the intent here was to get some alignment in the table entries. But alignment can be achieved by simply using
void*
and/orlong long
. UsingCFE_SB_Buffer_t
in this context has unsafe implications.Reporter Info
Joseph Hickey, Vantage Systems, Inc.
The text was updated successfully, but these errors were encountered: