From 5b6c2f29db006c05be302a3f7692cbca2651b666 Mon Sep 17 00:00:00 2001 From: AniruddhaKanhere <60444055+AniruddhaKanhere@users.noreply.github.com> Date: Tue, 7 Jul 2026 21:45:46 -0700 Subject: [PATCH] MSVC-MingW: bounds-check interrupt number in FromWindowsThread path Defect: vPortGenerateSimulatedInterruptFromWindowsThread() in the MSVC-MingW simulator port performs a shift by a caller-supplied interrupt number without range checking it, giving undefined behavior for out-of-range values. Root cause: the function pends an interrupt via ( 1UL << ulInterruptNumber ) into ulPendingInterrupts, but does not verify ulInterruptNumber is within the width of that variable. A value greater than or equal to portMAX_INTERRUPTS makes the shift undefined. The task-context sibling vPortGenerateSimulatedInterrupt() already performs this bounds check. Fix: gate the operation on ( ulInterruptNumber < portMAX_INTERRUPTS ) in addition to the existing xPortRunning check, mirroring the task-context sibling so both entry points are consistent. A host regression test kept outside this repository demonstrates the fault before the change and its absence afterwards (red then green). --- portable/MSVC-MingW/port.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/portable/MSVC-MingW/port.c b/portable/MSVC-MingW/port.c index 40458682b..2c62986ae 100644 --- a/portable/MSVC-MingW/port.c +++ b/portable/MSVC-MingW/port.c @@ -637,7 +637,11 @@ void vPortGenerateSimulatedInterrupt( uint32_t ulInterruptNumber ) void vPortGenerateSimulatedInterruptFromWindowsThread( uint32_t ulInterruptNumber ) { - if( xPortRunning == pdTRUE ) + /* Reject out-of-range interrupt numbers before the shift below. Mirrors the + * bounds check the task-context sibling vPortGenerateSimulatedInterrupt already + * performs: ( 1UL << ulInterruptNumber ) is undefined when ulInterruptNumber is + * >= portMAX_INTERRUPTS (the width of ulPendingInterrupts). */ + if( ( xPortRunning == pdTRUE ) && ( ulInterruptNumber < portMAX_INTERRUPTS ) ) { /* Can't proceed if in a critical section as pvInterruptEventMutex won't * be available. */