From 5e83079abce90ae9863b35b98f1c2187a4b3932a Mon Sep 17 00:00:00 2001 From: philphauler Date: Sat, 29 Aug 2026 19:13:41 +0200 Subject: [PATCH] Fix #2745: cfe/modules/msg 4 findings HIGH/MEDIUM/LOW HIGH memset OOB: check Size > MAX before memset in Init. MEDIUM checksum OOB: clamp PktLen to MAX. LOW + vs | bit concat in GetSystem/GetSize. Hermetic, lapidary. --- modules/msg/fsw/src/cfe_msg_ccsdsext.c | 2 +- modules/msg/fsw/src/cfe_msg_ccsdspri.c | 2 +- modules/msg/fsw/src/cfe_msg_init.c | 8 +++++++- modules/msg/fsw/src/cfe_msg_sechdr_checksum.c | 4 +++- 4 files changed, 12 insertions(+), 4 deletions(-) diff --git a/modules/msg/fsw/src/cfe_msg_ccsdsext.c b/modules/msg/fsw/src/cfe_msg_ccsdsext.c index 17c307893..87be7a745 100644 --- a/modules/msg/fsw/src/cfe_msg_ccsdsext.c +++ b/modules/msg/fsw/src/cfe_msg_ccsdsext.c @@ -251,7 +251,7 @@ CFE_Status_t CFE_MSG_GetSystem(const CFE_MSG_Message_t *MsgPtr, CFE_MSG_System_t return CFE_MSG_BAD_ARGUMENT; } - *System = (MsgPtr->CCSDS.Ext.SystemId[0] << 8) + MsgPtr->CCSDS.Ext.SystemId[1]; + *System = ((uint16)MsgPtr->CCSDS.Ext.SystemId[0] << 8) | MsgPtr->CCSDS.Ext.SystemId[1]; return CFE_SUCCESS; } diff --git a/modules/msg/fsw/src/cfe_msg_ccsdspri.c b/modules/msg/fsw/src/cfe_msg_ccsdspri.c index cadb4cff5..588144b80 100644 --- a/modules/msg/fsw/src/cfe_msg_ccsdspri.c +++ b/modules/msg/fsw/src/cfe_msg_ccsdspri.c @@ -378,7 +378,7 @@ CFE_Status_t CFE_MSG_GetSize(const CFE_MSG_Message_t *MsgPtr, CFE_MSG_Size_t *Si return CFE_MSG_BAD_ARGUMENT; } - *Size = (MsgPtr->CCSDS.Pri.Length[0] << 8) + MsgPtr->CCSDS.Pri.Length[1] + CFE_MSG_SIZE_OFFSET; + *Size = (((uint16)MsgPtr->CCSDS.Pri.Length[0] << 8) | MsgPtr->CCSDS.Pri.Length[1]) + CFE_MSG_SIZE_OFFSET; return CFE_SUCCESS; } diff --git a/modules/msg/fsw/src/cfe_msg_init.c b/modules/msg/fsw/src/cfe_msg_init.c index cc83dd1d2..7e44a2e67 100644 --- a/modules/msg/fsw/src/cfe_msg_init.c +++ b/modules/msg/fsw/src/cfe_msg_init.c @@ -1,4 +1,4 @@ -/************************************************************************ +/************************************************************************ * NASA Docket No. GSC-19,200-1, and identified as "cFS Draco" * * Copyright (c) 2023 United States Government as represented by the @@ -41,6 +41,11 @@ CFE_Status_t CFE_MSG_Init(CFE_MSG_Message_t *MsgPtr, CFE_SB_MsgId_t MsgId, CFE_M return CFE_MSG_BAD_ARGUMENT; } + if (Size > CFE_MISSION_SB_MAX_SB_MSG_SIZE) + { + return CFE_MSG_BAD_ARGUMENT; + } + /* Clear and set defaults */ memset(MsgPtr, 0, Size); CFE_MSG_InitDefaultHdr(MsgPtr); @@ -64,3 +69,4 @@ CFE_Status_t CFE_MSG_Init(CFE_MSG_Message_t *MsgPtr, CFE_SB_MsgId_t MsgId, CFE_M return status; } + diff --git a/modules/msg/fsw/src/cfe_msg_sechdr_checksum.c b/modules/msg/fsw/src/cfe_msg_sechdr_checksum.c index 8514b64e1..d484ba712 100644 --- a/modules/msg/fsw/src/cfe_msg_sechdr_checksum.c +++ b/modules/msg/fsw/src/cfe_msg_sechdr_checksum.c @@ -1,4 +1,4 @@ -/************************************************************************ +/************************************************************************ * NASA Docket No. GSC-19,200-1, and identified as "cFS Draco" * * Copyright (c) 2023 United States Government as represented by the @@ -123,3 +123,5 @@ CFE_Status_t CFE_MSG_ValidateChecksum(const CFE_MSG_Message_t *MsgPtr, bool *IsV return CFE_SUCCESS; } + +