[19416] Fix bad-free when receiving malformed DATA submessage #3824

MiguelCompany · 2023-09-01T08:58:36Z

Description

This PR:

Adds a custom transport that enables injecting arbitrary RTPS datagrams
Adds a black-box test that reads RTPS datagrams from binary files and injects them using the new transport
Adds a regression datagram for [16784] Malformed DATA submessage leads to bad-free during SPDP #3207
Fixes [16784] Malformed DATA submessage leads to bad-free during SPDP #3207

@Mergifyio backport 2.11.x 2.10.x 2.6.x

Contributor Checklist

Commit messages follow the project guidelines.
The code follows the style guidelines of this project.
Tests that thoroughly check the new feature have been added/Regression tests checking the bug and its fix have been added; the added tests pass locally
N/A Any new/modified methods have been properly documented using Doxygen.
Changes are ABI compatible.
Changes are API compatible.
N/A New feature has been added to the versions.md file (if applicable).
N/A New feature has been documented/Current behavior is correctly described in the documentation.
Applicable backports have been included in the description.

Reviewer Checklist

The PR has a milestone assigned.
Check contributor checklist is correct.
Check CI results: changes do not issue any warning.
Check CI results: failing tests are unrelated with the changes.

MiguelCompany · 2023-09-01T09:08:54Z

@richiprosima Please test this

MiguelCompany · 2023-09-02T11:48:56Z

@richiprosima Please test mac

MiguelCompany · 2023-09-04T06:50:41Z

@richiprosima Please test this

EduPonz

A much needed tool indeed!
Just a some NITs.

test/blackbox/common/BlackboxTestsTransportUDP.cpp

test/blackbox/common/DatagramInjectionTransport.hpp

src/cpp/rtps/messages/MessageReceiver.cpp

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

EduPonz · 2023-09-19T12:17:44Z

@richiprosima please test this

EduPonz · 2023-09-20T06:59:30Z

@Mergifyio backport 2.11.x 2.10.x 2.6.x

mergify · 2023-09-20T06:59:35Z

backport 2.11.x 2.10.x 2.6.x

✅ Backports have been created

#3860 [19416] Fix bad-free when receiving malformed DATA submessage (backport #3824) has been created for branch 2.11.x
#3861 [19416] Fix bad-free when receiving malformed DATA submessage (backport #3824) has been created for branch 2.10.x
#3862 [19416] Fix bad-free when receiving malformed DATA submessage (backport #3824) has been created for branch 2.6.x but encountered conflicts

* Refs #16784. Added basic custom chaining transport. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Use custom transport to get list of receiver interfaces. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Added regression file. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Processing regression files. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Separation of transport and descriptor. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Small refactor. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Fix issue. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #19416. Fix build error in Mac. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #19416. Fix include order. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> --------- Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> (cherry picked from commit 47fe5d7)

* Refs #16784. Added basic custom chaining transport. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Use custom transport to get list of receiver interfaces. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Added regression file. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Processing regression files. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Separation of transport and descriptor. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Small refactor. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Fix issue. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #19416. Fix build error in Mac. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #19416. Fix include order. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> --------- Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> (cherry picked from commit 47fe5d7) # Conflicts: # src/cpp/rtps/messages/MessageReceiver.cpp # test/blackbox/CMakeLists.txt

* Fix bad-free when receiving malformed DATA submessage (#3824) * Refs #16784. Added basic custom chaining transport. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Use custom transport to get list of receiver interfaces. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Added regression file. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Processing regression files. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Separation of transport and descriptor. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Small refactor. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #16784. Fix issue. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #19416. Fix build error in Mac. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> * Refs #19416. Fix include order. Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> --------- Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> (cherry picked from commit 47fe5d7) # Conflicts: # src/cpp/rtps/messages/MessageReceiver.cpp # test/blackbox/CMakeLists.txt * Fixed conflicts Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> --------- Signed-off-by: Miguel Company <MiguelCompany@eprosima.com> Co-authored-by: Miguel Company <miguelcompany@eprosima.com>

MiguelCompany added this to the v2.12.0 milestone Sep 1, 2023

MiguelCompany force-pushed the bugfix/16784 branch from 57b6423 to 143f69f Compare September 1, 2023 09:07

MiguelCompany force-pushed the bugfix/16784 branch from 0c5c6d2 to b1b5384 Compare September 4, 2023 06:42

EduPonz requested changes Sep 19, 2023

View reviewed changes

test/blackbox/common/BlackboxTestsTransportUDP.cpp Outdated Show resolved Hide resolved

test/blackbox/common/DatagramInjectionTransport.hpp Outdated Show resolved Hide resolved

src/cpp/rtps/messages/MessageReceiver.cpp Show resolved Hide resolved

MiguelCompany added 9 commits September 19, 2023 13:13

Refs #16784. Added basic custom chaining transport.

8b3bd39

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

Refs #16784. Use custom transport to get list of receiver interfaces.

960c3d6

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

Refs #16784. Added regression file.

15a2527

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

Refs #16784. Processing regression files.

1481a81

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

Refs #16784. Separation of transport and descriptor.

2b783bd

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

Refs #16784. Small refactor.

ee76c49

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

Refs #16784. Fix issue.

6fdbe79

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

Refs #19416. Fix build error in Mac.

ee95b87

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

Refs #19416. Fix include order.

34f764b

Signed-off-by: Miguel Company <MiguelCompany@eprosima.com>

MiguelCompany force-pushed the bugfix/16784 branch from f9e5499 to 34f764b Compare September 19, 2023 11:14

EduPonz approved these changes Sep 19, 2023

View reviewed changes

EduPonz merged commit 47fe5d7 into master Sep 20, 2023
11 of 14 checks passed

EduPonz deleted the bugfix/16784 branch September 20, 2023 06:31

mergify bot mentioned this pull request Sep 20, 2023

[19416] Fix bad-free when receiving malformed DATA submessage (backport #3824) #3860

Merged

mergify bot mentioned this pull request Sep 20, 2023

[19416] Fix bad-free when receiving malformed DATA submessage (backport #3824) #3861

Merged

mergify bot mentioned this pull request Sep 20, 2023

[19416] Fix bad-free when receiving malformed DATA submessage (backport #3824) #3862

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[19416] Fix bad-free when receiving malformed DATA submessage #3824

[19416] Fix bad-free when receiving malformed DATA submessage #3824

MiguelCompany commented Sep 1, 2023 •

edited by EduPonz

MiguelCompany commented Sep 1, 2023

MiguelCompany commented Sep 2, 2023

MiguelCompany commented Sep 4, 2023

EduPonz left a comment

EduPonz commented Sep 19, 2023

EduPonz commented Sep 20, 2023

mergify bot commented Sep 20, 2023 •

edited

[19416] Fix bad-free when receiving malformed DATA submessage #3824

[19416] Fix bad-free when receiving malformed DATA submessage #3824

Conversation

MiguelCompany commented Sep 1, 2023 • edited by EduPonz

Description

Contributor Checklist

Reviewer Checklist

MiguelCompany commented Sep 1, 2023

MiguelCompany commented Sep 2, 2023

MiguelCompany commented Sep 4, 2023

EduPonz left a comment

Choose a reason for hiding this comment

EduPonz commented Sep 19, 2023

EduPonz commented Sep 20, 2023

mergify bot commented Sep 20, 2023 • edited

✅ Backports have been created

MiguelCompany commented Sep 1, 2023 •

edited by EduPonz

mergify bot commented Sep 20, 2023 •

edited