Skip to content

fix possible NULL pointer dereference after call to configASSERT() #1284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aggarg merged 1 commit into from
Jun 30, 2025
Merged

fix possible NULL pointer dereference after call to configASSERT() #1284

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 8 additions & 15 deletions queue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1175,9 +1175,8 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue,

traceENTER_xQueueGenericSendFromISR( xQueue, pvItemToQueue, pxHigherPriorityTaskWoken, xCopyPosition );

configASSERT( pxQueue );
configASSERT( !( ( pvItemToQueue == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) );
configASSERT( !( ( xCopyPosition == queueOVERWRITE ) && ( pxQueue->uxLength != 1 ) ) );
configASSERT( ( pxQueue != NULL ) && !( ( pvItemToQueue == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) );
configASSERT( ( pxQueue != NULL ) && !( ( xCopyPosition == queueOVERWRITE ) && ( pxQueue->uxLength != 1 ) ) );

/* RTOS ports that support interrupt nesting have the concept of a maximum
* system call (or maximum API call) interrupt priority. Interrupts that are
Expand Down Expand Up @@ -1351,16 +1350,14 @@ BaseType_t xQueueGiveFromISR( QueueHandle_t xQueue,
* not (i.e. has a task with a higher priority than us been woken by this
* post). */

configASSERT( pxQueue );

/* xQueueGenericSendFromISR() should be used instead of xQueueGiveFromISR()
* if the item size is not 0. */
configASSERT( pxQueue->uxItemSize == 0 );
configASSERT( ( pxQueue != NULL ) && ( pxQueue->uxItemSize == 0 ) );

/* Normally a mutex would not be given from an interrupt, especially if
* there is a mutex holder, as priority inheritance makes no sense for an
* interrupts, only tasks. */
configASSERT( !( ( pxQueue->uxQueueType == queueQUEUE_IS_MUTEX ) && ( pxQueue->u.xSemaphore.xMutexHolder != NULL ) ) );
* interrupt, only tasks. */
configASSERT( ( pxQueue != NULL ) && !( ( pxQueue->uxQueueType == queueQUEUE_IS_MUTEX ) && ( pxQueue->u.xSemaphore.xMutexHolder != NULL ) ) );

/* RTOS ports that support interrupt nesting have the concept of a maximum
* system call (or maximum API call) interrupt priority. Interrupts that are
Expand Down Expand Up @@ -1895,12 +1892,9 @@ BaseType_t xQueuePeek( QueueHandle_t xQueue,

traceENTER_xQueuePeek( xQueue, pvBuffer, xTicksToWait );

/* Check the pointer is not NULL. */
configASSERT( ( pxQueue ) );

/* The buffer into which data is received can only be NULL if the data size
* is zero (so no data is copied into the buffer. */
configASSERT( !( ( ( pvBuffer ) == NULL ) && ( ( pxQueue )->uxItemSize != ( UBaseType_t ) 0U ) ) );
configASSERT( ( pxQueue != NULL ) && !( ( ( pvBuffer ) == NULL ) && ( ( pxQueue )->uxItemSize != ( UBaseType_t ) 0U ) ) );

/* Cannot block if the scheduler is suspended. */
#if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) )
Expand Down Expand Up @@ -2152,9 +2146,8 @@ BaseType_t xQueuePeekFromISR( QueueHandle_t xQueue,

traceENTER_xQueuePeekFromISR( xQueue, pvBuffer );

configASSERT( pxQueue );
configASSERT( !( ( pvBuffer == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) );
configASSERT( pxQueue->uxItemSize != 0 ); /* Can't peek a semaphore. */
configASSERT( ( pxQueue != NULL ) && !( ( pvBuffer == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) );
configASSERT( ( pxQueue != NULL ) && ( pxQueue->uxItemSize != 0 ) ); /* Can't peek a semaphore. */

/* RTOS ports that support interrupt nesting have the concept of a maximum
* system call (or maximum API call) interrupt priority. Interrupts that are
Expand Down
6 changes: 2 additions & 4 deletions stream_buffer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1653,11 +1653,9 @@ void vStreamBufferSetStreamBufferNotificationIndex( StreamBufferHandle_t xStream

traceENTER_vStreamBufferSetStreamBufferNotificationIndex( xStreamBuffer, uxNotificationIndex );

configASSERT( pxStreamBuffer );

/* There should be no task waiting otherwise we'd never resume them. */
configASSERT( pxStreamBuffer->xTaskWaitingToReceive == NULL );
configASSERT( pxStreamBuffer->xTaskWaitingToSend == NULL );
configASSERT( ( pxStreamBuffer != NULL ) && ( pxStreamBuffer->xTaskWaitingToReceive == NULL ) );
configASSERT( ( pxStreamBuffer != NULL ) && ( pxStreamBuffer->xTaskWaitingToSend == NULL ) );

/* Check that the task notification index is valid. */
configASSERT( uxNotificationIndex < configTASK_NOTIFICATION_ARRAY_ENTRIES );
Expand Down