Skip to content

[BUG] erpcgen C++ list decoder dereferences NULL after allocation failure #485

Description

@cognexjoshleonard

Describe the bug

The C++ read_list_uint8_1_t_struct code generated by erpcgen can dereference a null pointer when erpc_malloc() fails while decoding a non-empty list.

Codec::updateStatus() only records the error; it does not short-circuit the method. The list decoder therefore continues to its element loop and indexes the failed allocation.

To Reproduce (Example)

server.cpp

// Read struct list_uint8_1_t function implementation
static void read_list_uint8_1_t_struct(erpc::Codec * codec, list_uint8_1_t * data)
{
    if(NULL == data)
    {
        return;
    }

    codec->startReadList(data->elementsCount);
    data->elements = (uint8_t *) erpc_malloc(data->elementsCount * sizeof(uint8_t));
    if ((data->elements == NULL) && (data->elementsCount > 0))
    {
        codec->updateStatus(kErpcStatus_MemoryError);
        // No exit <<<----------------------
    }
    for (uint32_t listCount = 0U; listCount < data->elementsCount; ++listCount)
    {
        codec->read(data->elements[listCount]);
    }
}

eRPC Version: 1.13.0

Steps you didn't forgot to do

  • I checked if there is no related issue opened/closed.
  • I checked that there doesn't exist opened PR which is solving this issue.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions