Skip to content

Fix UB in accessing the keys (backport #879) #883

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
clalancette merged 1 commit into from
May 5, 2026
+17 −14
Merged

Fix UB in accessing the keys (backport #879) #883

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions rmw_fastrtps_cpp/src/type_support_common.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ void TypeSupport::set_members(const message_type_support_callbacks_t * members)

key_max_serialized_size_ = key_callbacks_->max_serialized_size_key(key_is_unbounded_);
if (!key_is_unbounded_) {
key_buffer_.reserve(key_max_serialized_size_);
key_buffer_.resize(key_max_serialized_size_);
}
}
}
Expand Down Expand Up @@ -165,7 +165,7 @@ bool TypeSupport::get_key_hash_from_ros_message(
key_max_serialized_size_ = (std::max) (
key_max_serialized_size_,
key_callbacks_->get_serialized_size_key(ros_message));
key_buffer_.reserve(key_max_serialized_size_);
key_buffer_.resize(key_max_serialized_size_);
}

eprosima::fastcdr::FastBuffer fast_buffer(
Expand All @@ -179,7 +179,7 @@ bool TypeSupport::get_key_hash_from_ros_message(

const size_t max_serialized_key_length = 16;

auto ser_length = ser.get_serialized_data_length();
const auto ser_length = ser.get_serialized_data_length();

// check for md5
if (force_md5 || key_max_serialized_size_ > max_serialized_key_length) {
Expand Down
2 changes: 1 addition & 1 deletion rmw_fastrtps_dynamic_cpp/src/MessageTypeSupport_impl.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ MessageTypeSupport<MembersType>::MessageTypeSupport(
if (this->members_->has_any_key_member_) {
this->key_max_serialized_size_ = this->calculateMaxSerializedKeySize(members);
this->is_compute_key_provided = true;
this->key_buffer_.reserve(this->key_max_serialized_size_);
this->key_buffer_.resize(this->key_max_serialized_size_);
}

// Account for RTPS submessage alignment
Expand Down
4 changes: 2 additions & 2 deletions rmw_fastrtps_dynamic_cpp/src/ServiceTypeSupport_impl.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ RequestTypeSupport<ServiceMembersType, MessageMembersType>::RequestTypeSupport(
if (this->members_->has_any_key_member_) {
this->key_max_serialized_size_ = this->calculateMaxSerializedKeySize(this->members_);
this->is_compute_key_provided = true;
this->key_buffer_.reserve(this->key_max_serialized_size_);
this->key_buffer_.resize(this->key_max_serialized_size_);
}

// Account for RTPS submessage alignment
Expand Down Expand Up @@ -109,7 +109,7 @@ ResponseTypeSupport<ServiceMembersType, MessageMembersType>::ResponseTypeSupport
if (this->members_->has_any_key_member_) {
this->key_max_serialized_size_ = this->calculateMaxSerializedKeySize(this->members_);
this->is_compute_key_provided = true;
this->key_buffer_.reserve(this->key_max_serialized_size_);
this->key_buffer_.resize(this->key_max_serialized_size_);
}

// Account for RTPS submessage alignment
Expand Down
19 changes: 11 additions & 8 deletions rmw_fastrtps_dynamic_cpp/src/TypeSupport_impl.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
#include <cassert>
#include <cstddef>
#include <cstdint>
#include <cstring>
#include <string>
#include <vector>

Expand Down Expand Up @@ -363,7 +364,7 @@ bool TypeSupport<MembersType>::get_key_hash_from_ros_message(
this->key_max_serialized_size_ =
(std::max) (this->key_max_serialized_size_,
this->getEstimatedSerializedKeySize(members, ros_message));
key_buffer_.reserve(this->key_max_serialized_size_);
key_buffer_.resize(this->key_max_serialized_size_);
}

eprosima::fastcdr::FastBuffer buffer(
Expand All @@ -376,22 +377,24 @@ bool TypeSupport<MembersType>::get_key_hash_from_ros_message(
// serialize
serializeKeyROSmessage(ser, members_, ros_message);

// check for md5
const size_t max_serialized_key_length = 16;

const auto ser_length = ser.get_serialized_data_length();

if (force_md5 || this->key_max_serialized_size_ > 16) {
md5_.init();

md5_.update(
this->key_buffer_.data(),
static_cast<unsigned int>(ser.get_serialized_data_length()));
md5_.update(key_buffer_.data(), static_cast<unsigned int>(ser_length));

md5_.finalize();

for (uint8_t i = 0; i < 16; ++i) {
for (uint8_t i = 0; i < max_serialized_key_length; ++i) {
ihandle->value[i] = md5_.digest[i];
}
} else {
for (uint8_t i = 0; i < 16; ++i) {
ihandle->value[i] = this->key_buffer_[i];
memset(ihandle->value, 0, max_serialized_key_length);
for (uint8_t i = 0; i < ser_length; ++i) {
ihandle->value[i] = key_buffer_[i];
}
}

Expand Down