Skip to content

fix(es): use PLATFORM bound for pool bucket array size check - #2829

Open
philphauler wants to merge 1 commit into
nasa:devfrom
philphauler:fix-pool-bounds-check
Open

philphauler wants to merge 1 commit into
nasa:devfrom
philphauler:fix-pool-bounds-check

Conversation

@philphauler

@philphauler philphauler commented Sep 3, 2026 •

Copy link
Copy Markdown
Contributor

Checklist (Please check before submitting)

Describe the contribution

Fixes #2828. In CFE_ES_PoolCreateEx_WithAlignment(), NumBlockSizes is checked against CFE_MISSION_ES_POOL_MAX_BUCKETS, but the Buckets[] array is sized to CFE_PLATFORM_ES_POOL_MAX_BUCKETS. When MISSION > PLATFORM (valid per cfe_missionlib_verify.h), the bounds check passes but subsequent writes exceed the array, causing OOB writes.

One-line fix: replace CFE_MISSION_ES_POOL_MAX_BUCKETS with CFE_PLATFORM_ES_POOL_MAX_BUCKETS in cfe_es_mempool.c so the check matches the actual array size.

Testing performed

The bucket-count check in cfe_es_mempool.c now uses the PLATFORM bound the array is allocated with, and the syslog prints that same bound. Run locally in the cFS dev bundle: coverage-es passes. With sample_defs (MISSION == PLATFORM == 17) behavior is unchanged; the check only differs when a mission raises the MISSION bound above the PLATFORM allocation.

Expected behavior changes

Configurations where CFE_MISSION_ES_POOL_MAX_BUCKETS > CFE_PLATFORM_ES_POOL_MAX_BUCKETS now correctly reject excess bucket counts instead of writing out of bounds.

System(s) tested on

Hardware: x86_64 (WSL2), OS: Ubuntu 22.04, Versions: cFE dev 2612eb0 with OSAL and PSP from the cFS dev bundle, native build with ENABLE_UNIT_TESTS

Contributor Info

Filip Koscak - phil.phaulre@gmail.com

The NumBlockSizes validation in CFE_ES_PoolCreateEx_WithAlignment uses
CFE_MISSION_ES_POOL_MAX_BUCKETS, but the actual Buckets array in
CFE_ES_GenPoolRecord_t is sized to CFE_PLATFORM_ES_POOL_MAX_BUCKETS.

When MISSION > PLATFORM (a valid, documented configuration), this allows
NumBlockSizes values that overflow the array in GenPoolInitialize,
corrupting adjacent entries in the global pool table.
@philphauler
philphauler force-pushed the fix-pool-bounds-check branch from e9031dc to b3c8f82 Compare September 5, 2026 20:55
@philphauler

Copy link
Copy Markdown
Contributor Author

Hi @dzbaker 👋 thanks for the nudge. Commit message now matches the check (b3c8f82), and the syslog prints the same PLATFORM bound the check uses. coverage-es passes. Have a nice day!

czogby-nasa
czogby-nasa previously approved these changes Sep 10, 2026
@dzbaker
dzbaker self-requested a review September 10, 2026 14:52
@dzbaker
dzbaker dismissed czogby-nasa’s stale review September 10, 2026 14:53

Going to assign review to cFS Core dev team.

@philphauler

Copy link
Copy Markdown
Contributor Author

Nice! Sorry for taking the time, I'll also sign the CLA thingy asap, and run some more online courses to become actually more useful 🙏🙌

@philphauler

Copy link
Copy Markdown
Contributor Author

Quick update: my Individual CLA for the cFS framework went to GSFC-SoftwareRelease on 2026-09-16, after this PR was opened, so I've ticked that box in the checklist. Happy to adjust anything if needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CFE_ES_PoolCreateEx bounds check uses wrong constant (MISSION vs PLATFORM)

3 participants