[x] I performed a cursory search to see if the bug report is relevant, not redundant, nor in conflict with other tickets.
Describe the bug
The 3rd parameter of CFE_MSG_Init() is supposed to indicate the actual size of the structure/buffer being initialized. In general, this must be at least the size of the primary header in order to be valid.
CF (at first) passes this as 0, then overwrites this with the real size later on.
The problem is, a size of 0 is totally invalid, and to be correct, CFE_MSG_Init() should not be writing any values into a structure that is smaller than the size of a primary header, as this is an error. Writing any value into a struct of size 0 is a write-beyond-bounds error, and thus the fact that the default CFE_MSG_Init() even allows this is a bug.
To Reproduce
Run CF with a proper implementation of CFE_MSG_Init() - i.e. one that verifies the size is valid. When passed a size of 0, none of the header fields will be set (correct behavior). This results in the buffer being in an indeterminate state, and the MsgId will not be set.
Expected behavior
The MsgId needs to be set by the call to CFE_MSG_Init
Checklist (Please check before submitting)
Describe the bug The 3rd parameter of
CFE_MSG_Init()is supposed to indicate the actual size of the structure/buffer being initialized. In general, this must be at least the size of the primary header in order to be valid.CF (at first) passes this as 0, then overwrites this with the real size later on.
The problem is, a size of 0 is totally invalid, and to be correct,
CFE_MSG_Init()should not be writing any values into a structure that is smaller than the size of a primary header, as this is an error. Writing any value into a struct of size 0 is a write-beyond-bounds error, and thus the fact that the default CFE_MSG_Init() even allows this is a bug.To Reproduce Run CF with a proper implementation of
CFE_MSG_Init()- i.e. one that verifies the size is valid. When passed a size of 0, none of the header fields will be set (correct behavior). This results in the buffer being in an indeterminate state, and the MsgId will not be set.Expected behavior The MsgId needs to be set by the call to
CFE_MSG_InitCode snips https://github.com/nasa/CF/blob/38cfee8a2284fc7605e6fb2b2556b528dcf62499/fsw/src/cf_cfdp_sbintf.c#L120-L121
Reporter Info Joseph Hickey, Vantage Systems, Inc.