Skip to content

Commit d847f2c

Browse files
fix(freertos): Limit idle task name length copy operation
This commit limits the idle task name length copy operation to prevent Out-of-bounds memory access warnings from static code analyzers. Signed-off-by: Sudeep Mohanty <sudeep.mohanty@espressif.com>
1 parent 974351f commit d847f2c

File tree

1 file changed

+13
-30
lines changed

1 file changed

+13
-30
lines changed

tasks.c

Lines changed: 13 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3521,26 +3521,12 @@ static BaseType_t prvCreateIdleTasks( void )
35213521
{
35223522
BaseType_t xReturn = pdPASS;
35233523
BaseType_t xCoreID;
3524-
char cIdleName[ configMAX_TASK_NAME_LEN ];
3524+
char cIdleName[ configMAX_TASK_NAME_LEN ] = { 0 };
35253525
TaskFunction_t pxIdleTaskFunction = NULL;
3526-
BaseType_t xIdleTaskNameIndex;
35273526

3528-
for( xIdleTaskNameIndex = ( BaseType_t ) 0; xIdleTaskNameIndex < ( BaseType_t ) configMAX_TASK_NAME_LEN; xIdleTaskNameIndex++ )
3529-
{
3530-
cIdleName[ xIdleTaskNameIndex ] = configIDLE_TASK_NAME[ xIdleTaskNameIndex ];
3531-
3532-
/* Don't copy all configMAX_TASK_NAME_LEN if the string is shorter than
3533-
* configMAX_TASK_NAME_LEN characters just in case the memory after the
3534-
* string is not accessible (extremely unlikely). */
3535-
if( cIdleName[ xIdleTaskNameIndex ] == ( char ) 0x00 )
3536-
{
3537-
break;
3538-
}
3539-
else
3540-
{
3541-
mtCOVERAGE_TEST_MARKER();
3542-
}
3543-
}
3527+
/* Copy the name of the idle task up to configMAX_TASK_NAME_LEN - 1 characters, leaving room for the null-terminator */
3528+
strncpy( cIdleName, configIDLE_TASK_NAME, configMAX_TASK_NAME_LEN - 1 );
3529+
cIdleName[ configMAX_TASK_NAME_LEN - 1 ] = '\0';
35443530

35453531
/* Add each idle task at the lowest priority. */
35463532
for( xCoreID = ( BaseType_t ) 0; xCoreID < ( BaseType_t ) configNUMBER_OF_CORES; xCoreID++ )
@@ -3570,20 +3556,17 @@ static BaseType_t prvCreateIdleTasks( void )
35703556
* only one idle task. */
35713557
#if ( configNUMBER_OF_CORES > 1 )
35723558
{
3559+
BaseType_t uxIdleNameLength = strlen( cIdleName );
3560+
3561+
/* Convert the core ID to a string. */
3562+
char cCoreIDStr[ 11 ];
3563+
snprintf( cCoreIDStr, sizeof( cCoreIDStr ), "%d", xCoreID );
3564+
BaseType_t uxCoreIDStrLength = strlen( cCoreIDStr );
3565+
35733566
/* Append the idle task number to the end of the name if there is space. */
3574-
if( xIdleTaskNameIndex < ( BaseType_t ) configMAX_TASK_NAME_LEN )
3567+
if( uxIdleNameLength + uxCoreIDStrLength < ( BaseType_t ) configMAX_TASK_NAME_LEN )
35753568
{
3576-
cIdleName[ xIdleTaskNameIndex ] = ( char ) ( xCoreID + '0' );
3577-
3578-
/* And append a null character if there is space. */
3579-
if( ( xIdleTaskNameIndex + 1 ) < ( BaseType_t ) configMAX_TASK_NAME_LEN )
3580-
{
3581-
cIdleName[ xIdleTaskNameIndex + 1 ] = '\0';
3582-
}
3583-
else
3584-
{
3585-
mtCOVERAGE_TEST_MARKER();
3586-
}
3569+
strncat( cIdleName, cCoreIDStr, configMAX_TASK_NAME_LEN - uxIdleNameLength - 1 );
35873570
}
35883571
else
35893572
{

0 commit comments

Comments
 (0)