Skip to content

Commit 89d32c9

Browse files
fix(freertos): Limit idle task name copy operation and ensure null termination
This commit: - Limits the idle task name length copy operation to prevent Out-of-bounds memory access warnings from static code analyzers. - Fixes a bug where in the idle task name could be non null-terminated string for SMP configuration. Signed-off-by: Sudeep Mohanty <sudeep.mohanty@espressif.com>
1 parent 974351f commit 89d32c9

File tree

1 file changed

+16
-33
lines changed

1 file changed

+16
-33
lines changed

tasks.c

Lines changed: 16 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -3521,27 +3521,26 @@ static BaseType_t prvCreateIdleTasks( void )
35213521
{
35223522
BaseType_t xReturn = pdPASS;
35233523
BaseType_t xCoreID;
3524-
char cIdleName[ configMAX_TASK_NAME_LEN ];
3524+
char cIdleName[ configMAX_TASK_NAME_LEN ] = { 0 };
35253525
TaskFunction_t pxIdleTaskFunction = NULL;
35263526
BaseType_t xIdleTaskNameIndex;
35273527

3528-
for( xIdleTaskNameIndex = ( BaseType_t ) 0; xIdleTaskNameIndex < ( BaseType_t ) configMAX_TASK_NAME_LEN; xIdleTaskNameIndex++ )
3528+
configASSERT( configIDLE_TASK_NAME != NULL && configMAX_TASK_NAME_LEN > 3 );
3529+
3530+
/* The length of the idle task name is limited to the minimum of the length
3531+
* of configIDLE_TASK_NAME and configMAX_TASK_NAME_LEN - 2, keeping space
3532+
* for the core ID suffix and the null-terminator. */
3533+
BaseType_t xIdleNameLen = sizeof( configIDLE_TASK_NAME ) - 1;
3534+
BaseType_t xCopyLen = ( xIdleNameLen < configMAX_TASK_NAME_LEN - 2 ) ? xIdleNameLen : configMAX_TASK_NAME_LEN - 2;
3535+
3536+
for( xIdleTaskNameIndex = ( BaseType_t ) 0; xIdleTaskNameIndex < xCopyLen; xIdleTaskNameIndex++ )
35293537
{
35303538
cIdleName[ xIdleTaskNameIndex ] = configIDLE_TASK_NAME[ xIdleTaskNameIndex ];
3531-
3532-
/* Don't copy all configMAX_TASK_NAME_LEN if the string is shorter than
3533-
* configMAX_TASK_NAME_LEN characters just in case the memory after the
3534-
* string is not accessible (extremely unlikely). */
3535-
if( cIdleName[ xIdleTaskNameIndex ] == ( char ) 0x00 )
3536-
{
3537-
break;
3538-
}
3539-
else
3540-
{
3541-
mtCOVERAGE_TEST_MARKER();
3542-
}
35433539
}
35443540

3541+
/* Ensure null termination. */
3542+
cIdleName[ xIdleTaskNameIndex ] = '\0';
3543+
35453544
/* Add each idle task at the lowest priority. */
35463545
for( xCoreID = ( BaseType_t ) 0; xCoreID < ( BaseType_t ) configNUMBER_OF_CORES; xCoreID++ )
35473546
{
@@ -3570,25 +3569,9 @@ static BaseType_t prvCreateIdleTasks( void )
35703569
* only one idle task. */
35713570
#if ( configNUMBER_OF_CORES > 1 )
35723571
{
3573-
/* Append the idle task number to the end of the name if there is space. */
3574-
if( xIdleTaskNameIndex < ( BaseType_t ) configMAX_TASK_NAME_LEN )
3575-
{
3576-
cIdleName[ xIdleTaskNameIndex ] = ( char ) ( xCoreID + '0' );
3577-
3578-
/* And append a null character if there is space. */
3579-
if( ( xIdleTaskNameIndex + 1 ) < ( BaseType_t ) configMAX_TASK_NAME_LEN )
3580-
{
3581-
cIdleName[ xIdleTaskNameIndex + 1 ] = '\0';
3582-
}
3583-
else
3584-
{
3585-
mtCOVERAGE_TEST_MARKER();
3586-
}
3587-
}
3588-
else
3589-
{
3590-
mtCOVERAGE_TEST_MARKER();
3591-
}
3572+
/* Append the idle task number to the end of the name. */
3573+
cIdleName[ xIdleTaskNameIndex ] = ( char ) ( xCoreID + '0' );
3574+
cIdleName[ xIdleTaskNameIndex + 1 ] = '\0';
35923575
}
35933576
#endif /* if ( configNUMBER_OF_CORES > 1 ) */
35943577

0 commit comments

Comments
 (0)