Skip to content

Assert on matching channel size for duplicate channel IDs in TlmPacke…#5357

Open
Sammy-Dabbas wants to merge 1 commit into
nasa:develfrom
Sammy-Dabbas:fix/tlmpacketizer-dup-channel-size
Open

Assert on matching channel size for duplicate channel IDs in TlmPacke…#5357
Sammy-Dabbas wants to merge 1 commit into
nasa:develfrom
Sammy-Dabbas:fix/tlmpacketizer-dup-channel-size

Conversation

@Sammy-Dabbas

Copy link
Copy Markdown
Related Issue(s) #5132
Has Unit Tests (y/n) y
Documentation Included (y/n) n
Generative AI was used in this contribution (y/n) n

Change Description

TlmPacketizer's setPacketList stores each channel's serialized size in a single TlmEntry.channelSize. When the same channel ID appears in more than one packet, the loop overwrote that size with the last-seen value, so the earlier packet's buffer offsets (computed from the original size) no longer matched. The runtime memcpy in TlmRecv_handler/TlmGet_handler could then read or write past the channel's slot and overflow the fill buffer.

This stamps the size on the first sighting of a channel ID and FW_ASSERTs that any later sighting has the same size, mirroring the duplicate detection assert already present in the ignore-list loop. Identical-definition duplicates across packets behave exactly as before; a conflicting definition trips a configuration-time assert before any buffer is used.

Rationale

Fixes #5132. Per @LeStarch's clarification on the issue, a channel ID may repeat across packets as long as its definition is identical, so this allows matching duplicates and rejects only conflicting sizes.

Testing/Review Recommendations

Two unit tests added in Svc/TlmPacketizer/test/ut: DuplicateChannelIdMatchingSizeTest confirms an identical-size duplicate across two packets is accepted and both packets emit; DuplicateChannelIdConflictingSizeTest confirms a conflicting size trips the assert via ASSERT_DEATH_IF_SUPPORTED. I could not build locally (no C++ toolchain), so please rely on CI for the compile and unit-test run.

Future Work

None.

AI Usage (see policy)

No

…tizer

TlmEntry.channelSize was overwritten each time a channel ID recurred
across packets, so a channel declared with different sizes in two
packets corrupted the earlier packet's buffer offsets and overflowed
the fill buffer during TlmRecv/TlmGet copies. Stamp the size on the
first sighting and assert equality on subsequent sightings, mirroring
the duplicate-detection assert already used for the ignore list.
Identical duplicates across packets are still allowed.

Fixes nasa#5132.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

TlmPacketizer handling of a identical channel ID's could cause a buffer overflow

1 participant