ros-navigation / navigation2

ROS 2 Navigation Framework and System
https://nav2.org/
Other
2.34k stars 1.21k forks source link

heap-buffer-overflow bug caused by user misconfiguration (amcl:max_particles=a large value) #4335

Closed GoesM closed 2 months ago

GoesM commented 2 months ago

this issue is mainly for adding ticket for https://github.com/ros-navigation/navigation2/issues/4005

Bug report

Required Info:

Steps to reproduce issue

Here is our launch command:

source install/setup.bash
source /opt/ros/humble/setup.bash
export TURTLEBOT3_MODEL=waffle
export GAZEBO_MODEL_PATH=$GAZEBO_MODEL_PATH:/opt/ros/humble/share/turtlebot3_gazebo/models
ros2 launch nav2_bringup tb3_simulation_launch.py params_file:=my_nav2_params.yaml

there's only one difference between my_nav2_params.yaml and defaulted nav2_params.yaml:

#my_nav2_params.yaml
......
nav2_amcl
      ......
      max_particles: 906970164
    ......

Expected behavior

no bug occurs

Actual behavior

face to the asan report:

=================================================================
==7151==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0x920003e80 bytes
    #0 0x562fbdd48548 in __interceptor_calloc (/home/**/nav2_humble/install/nav2_amcl/lib/nav2_amcl/amcl+0xae548) (BuildId: 9cab2dfb4fd0f7edff9ad0c4896458037daa0009)
    #1 0x7f7cf5c44afa in pf_alloc (/home/**/nav2_humble/install/nav2_amcl/lib/libpf_lib.so+0x4afa) (BuildId: 73e413561c1948e30ca366fe29aeef8e601b70f9)
    #2 0x7f7cf6159b4b in nav2_amcl::AmclNode::on_configure(rclcpp_lifecycle::State const&) (/home/**/nav2_humble/install/nav2_amcl/lib/libamcl_core.so+0x359b4b) (BuildId: fcf524e51612a7063856b255b0200fa30f1c8a67)
    #3 0x7f7cf71a4b8c  (/opt/ros/humble/lib/librclcpp_lifecycle.so+0x28b8c) (BuildId: 012115a5136d65f945feb1fe7a699e9903b4add1)

==7151==ABORTING

Additional information

here's only check for if the value is negative, but it's not enough:

https://github.com/ros-navigation/navigation2/blob/4fa12acec79a08f472d9d04ac08997db47f2a398/nav2_amcl/src/amcl_node.cpp#L1119-L1124