Describe the bug
The C++ read_list_uint8_1_t_struct code generated by erpcgen can dereference a null pointer when erpc_malloc() fails while decoding a non-empty list.
Codec::updateStatus() only records the error; it does not short-circuit the method. The list decoder therefore continues to its element loop and indexes the failed allocation.
To Reproduce (Example)
server.cpp
// Read struct list_uint8_1_t function implementation
static void read_list_uint8_1_t_struct(erpc::Codec * codec, list_uint8_1_t * data)
{
if(NULL == data)
{
return;
}
codec->startReadList(data->elementsCount);
data->elements = (uint8_t *) erpc_malloc(data->elementsCount * sizeof(uint8_t));
if ((data->elements == NULL) && (data->elementsCount > 0))
{
codec->updateStatus(kErpcStatus_MemoryError);
// No exit <<<----------------------
}
for (uint32_t listCount = 0U; listCount < data->elementsCount; ++listCount)
{
codec->read(data->elements[listCount]);
}
}
eRPC Version: 1.13.0
Steps you didn't forgot to do
Describe the bug
The C++
read_list_uint8_1_t_structcode generated byerpcgencan dereference a null pointer whenerpc_malloc()fails while decoding a non-empty list.Codec::updateStatus()only records the error; it does not short-circuit the method. The list decoder therefore continues to its element loop and indexes the failed allocation.To Reproduce (Example)
server.cpp
eRPC Version: 1.13.0
Steps you didn't forgot to do