From 5f109e6f5546d6b328886a58aa0ec9fa96d87fe6 Mon Sep 17 00:00:00 2001
From: Kody Stribrny <89810515+kstribrnAmzn@users.noreply.github.com>
Date: Fri, 21 Aug 2026 09:22:13 -0700
Subject: [PATCH] fix: Verify queue set type during usage (#1476)

Verify that a queue set is passed when attempting
to add a queue to the queue set.
---
 queue.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/queue.c b/queue.c
index 83c7ac730..41ef8ef91 100644
--- a/queue.c
+++ b/queue.c
@@ -3225,7 +3225,16 @@ BaseType_t xQueueIsQueueFullFromISR( const QueueHandle_t xQueue )
 
         taskENTER_CRITICAL();
         {
-            if( ( ( Queue_t * ) xQueueOrSemaphore )->pxQueueSetContainer != NULL )
+            if( ( ( Queue_t * ) xQueueSet )->uxItemSize != ( UBaseType_t ) sizeof( Queue_t * ) )
+            {
+                /* The object passed as the queue set is not a queue set. A queue
+                 * set always has an item size of sizeof( Queue_t * ). Reject any
+                 * other object to prevent a type confusion in which
+                 * prvNotifyQueueSetContainer() would later copy uxItemSize bytes
+                 * from a single pointer on the stack. */
+                xReturn = pdFAIL;
+            }
+            else if( ( ( Queue_t * ) xQueueOrSemaphore )->pxQueueSetContainer != NULL )
             {
                 /* Cannot add a queue/semaphore to more than one queue set. */
                 xReturn = pdFAIL;