len0rd/FreeRTOS-Kernel
1
0
Fork 0
mirror of https://github.com/FreeRTOS/FreeRTOS-Kernel.git synced 2026-07-10 13:29:45 -04:00
Code Issues Projects Releases Packages Wiki Activity

MSVC-MingW: bounds-check interrupt number in FromWindowsThread path

Browse source 
Defect: vPortGenerateSimulatedInterruptFromWindowsThread() in the MSVC-MingW
simulator port performs a shift by a caller-supplied interrupt number without
range checking it, giving undefined behavior for out-of-range values.

Root cause: the function pends an interrupt via ( 1UL << ulInterruptNumber )
into ulPendingInterrupts, but does not verify ulInterruptNumber is within the
width of that variable. A value greater than or equal to portMAX_INTERRUPTS
makes the shift undefined. The task-context sibling
vPortGenerateSimulatedInterrupt() already performs this bounds check.

Fix: gate the operation on ( ulInterruptNumber < portMAX_INTERRUPTS ) in
addition to the existing xPortRunning check, mirroring the task-context sibling
so both entry points are consistent.

A host regression test kept outside this repository demonstrates the fault
before the change and its absence afterwards (red then green).
This commit is contained in:
AniruddhaKanhere 2026-07-07 21:45:46 -07:00
parent 3ac4495945
commit 5b6c2f29db
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
portable/MSVC-MingW/port.c
View file

@ -637,7 +637,11 @@ void vPortGenerateSimulatedInterrupt( uint32_t ulInterruptNumber )
void vPortGenerateSimulatedInterruptFromWindowsThread( uint32_t ulInterruptNumber )
{
if( xPortRunning == pdTRUE )
/* Reject out-of-range interrupt numbers before the shift below. Mirrors the
* bounds check the task-context sibling vPortGenerateSimulatedInterrupt already
* performs: ( 1UL << ulInterruptNumber ) is undefined when ulInterruptNumber is
* >= portMAX_INTERRUPTS (the width of ulPendingInterrupts). */
if( ( xPortRunning == pdTRUE ) && ( ulInterruptNumber < portMAX_INTERRUPTS ) )
{
/* Can't proceed if in a critical section as pvInterruptEventMutex won't
* be available. */