Checklist (Please check before submitting)
Describe the bug
The CFE_SB_Buffer_t is a special type, referring to message buffers that are allocated from the SB message pool. The only real source of these objects is the function CFE_SB_AllocateMessageBuffer().
Although this type is defined in a public header for API reasons, it should never be instantiated by apps, and doing so is unsafe. Passing such an object (a "CFE_SB_Buffer_t" instance that didn't actually come from CFE_SB_AllocateMessageBuffer()) to a function like CFE_SB_TransmitBuffer() will likely corrupt the memory pool - it is akin to calling free() on a block that didn't come from malloc().
Code snips
|
CFE_SB_Buffer_t Buffer; /**< \brief Message Buffer for alignment */ |
System observed on:
- Hardware
- OS: [e.g. Linux 4.4]
- Versions [e.g. cFE 6.6, OSAL 4.2, PSP 1.3 for mcp750, any related apps]
Additional context
It appears the intent here was to get some alignment in the table entries. But alignment can be achieved by simply using void* and/or long long. Using CFE_SB_Buffer_t in this context has unsafe implications.
Reporter Info
Joseph Hickey, Vantage Systems, Inc.
Checklist (Please check before submitting)
Describe the bug
The
CFE_SB_Buffer_tis a special type, referring to message buffers that are allocated from the SB message pool. The only real source of these objects is the functionCFE_SB_AllocateMessageBuffer().Although this type is defined in a public header for API reasons, it should never be instantiated by apps, and doing so is unsafe. Passing such an object (a "CFE_SB_Buffer_t" instance that didn't actually come from
CFE_SB_AllocateMessageBuffer()) to a function likeCFE_SB_TransmitBuffer()will likely corrupt the memory pool - it is akin to callingfree()on a block that didn't come frommalloc().Code snips
HS/config/default_hs_tblstruct.h
Line 93 in 4d38d46
System observed on:
Additional context
It appears the intent here was to get some alignment in the table entries. But alignment can be achieved by simply using
void*and/orlong long. UsingCFE_SB_Buffer_tin this context has unsafe implications.Reporter Info
Joseph Hickey, Vantage Systems, Inc.