Add check for overflow in queue size calculation.

eclipse-threadx · Dec 8, 2023 · 83a50f9 · 83a50f9
1 parent 776ea21
commit 83a50f9
Showing 1 changed file with 18 additions and 0 deletions.
diff --git a/utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c b/utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c
@@ -33,6 +33,10 @@
 /*                                            start flag, corrected stack */
 /*                                            allocation size,            */
 /*                                            resulting in version 6.1.12 */
+/*  xx-xx-xxxx     Xiuwen Cai               Modified comment(s), and      */
+/*                                            added check for overflow in */
+/*                                            queue size calculation,     */
+/*                                            resulting in version 6.x    */
 /*                                                                        */
 /**************************************************************************/
 
@@ -1526,6 +1530,13 @@ QueueHandle_t xQueueCreate(UBaseType_t uxQueueLength, UBaseType_t uxItemSize)
     }
 #endif
 
+    if ((uxQueueLength > (SIZE_MAX / uxItemSize)) ||
+        (uxQueueLength > (ULONG_MAX / uxItemSize))) {
+
+        /* Integer overflow in queue size */
+        return NULL;
+    }
+
     p_queue = txfr_malloc(sizeof(txfr_queue_t));
     if(p_queue == NULL) {
         return NULL;
@@ -2692,6 +2703,13 @@ QueueSetHandle_t xQueueCreateSet(const UBaseType_t uxEventQueueLength)
     }
 #endif
 
+    if ((uxEventQueueLength > (SIZE_MAX / sizeof(void *))) ||
+        (uxEventQueueLength > (ULONG_MAX / sizeof(void *)))) {
+
+        /* Integer overflow in queue size */
+        return NULL;
+    }
+
     p_set = txfr_malloc(sizeof(txfr_queueset_t));
     if(p_set == NULL) {
         return NULL;