CF invokes CFE_MSG_Init with size of 0

[jphickey]

Checklist (Please check before submitting)

• I reviewed the Contributing Guide.
• I performed a cursory search to see if the bug report is relevant, not redundant, nor in conflict with other tickets.

Describe the bug
The 3rd parameter of CFE_MSG_Init() is supposed to indicate the actual size of the structure/buffer being initialized. In general, this must be at least the size of the primary header in order to be valid.

CF (at first) passes this as 0, then overwrites this with the real size later on.

The problem is, a size of 0 is totally invalid, and to be correct, CFE_MSG_Init() should not be writing any values into a structure that is smaller than the size of a primary header, as this is an error. Writing any value into a struct of size 0 is a write-beyond-bounds error, and thus the fact that the default CFE_MSG_Init() even allows this is a bug.

To Reproduce
Run CF with a proper implementation of CFE_MSG_Init() - i.e. one that verifies the size is valid. When passed a size of 0, none of the header fields will be set (correct behavior). This results in the buffer being in an indeterminate state, and the MsgId will not be set.

Expected behavior
The MsgId needs to be set by the call to CFE_MSG_Init

Code snips

CF/fsw/src/cf_cfdp_sbintf.c

Lines 120 to 121 in 38cfee8

	CFE_MSG_Init(&CF_AppData.engine.out.msg->Msg,
	CFE_SB_ValueToMsgId(CF_AppData.config_table->chan[t->chan_num].mid_output), 0);

Reporter Info
Joseph Hickey, Vantage Systems, Inc.