Skip to content

Commit 0a36d9f

Browse files
Add missing null checks on PacketBufferHandle::New calls (#22274)
- Some callers of PacketBufferHandle::New did not null-check on failure to allocate. This is strongly linked to some crashes Fixes #22262 This PR: - Adds missing null checks required by API contract Testing done: - Unit tests still pass - Conditions under which a crash previously occured no longer see a crash occur in manual testing against a real DUT
1 parent 4bb79cc commit 0a36d9f

File tree

5 files changed

+12
-3
lines changed

5 files changed

+12
-3
lines changed

examples/chip-tool/commands/pairing/CloseSessionCommand.cpp

+3-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,9 @@ CHIP_ERROR CloseSessionCommand::CloseSession(Messaging::ExchangeManager & exchan
4444
SecureChannel::kProtocolCodeCloseSession);
4545

4646
size_t reportSize = statusReport.Size();
47-
Encoding::LittleEndian::PacketBufferWriter bbuf(MessagePacketBuffer::New(reportSize), reportSize);
47+
auto packetBuffer = MessagePacketBuffer::New(reportSize);
48+
VerifyOrReturnError(!packetBuffer.IsNull(), CHIP_ERROR_NO_MEMORY);
49+
Encoding::LittleEndian::PacketBufferWriter bbuf(std::move(packetBuffer), reportSize);
4850
statusReport.WriteToBuffer(bbuf);
4951

5052
System::PacketBufferHandle msg = bbuf.Finalize();

src/app/BufferedReadCallback.cpp

+1
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ CHIP_ERROR BufferedReadCallback::BufferListItem(TLV::TLVReader & reader)
117117
// we can improve this.
118118
//
119119
handle = System::PacketBufferHandle::New(chip::app::kMaxSecureSduLengthBytes);
120+
VerifyOrReturnError(!handle.IsNull(), CHIP_ERROR_NO_MEMORY);
120121

121122
writer.Init(std::move(handle), false);
122123

src/app/ClusterStateCache.cpp

+1
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ CHIP_ERROR ClusterStateCache::UpdateEventCache(const EventHeader & aEventHeader,
128128
return CHIP_NO_ERROR;
129129
}
130130
System::PacketBufferHandle handle = System::PacketBufferHandle::New(chip::app::kMaxSecureSduLengthBytes);
131+
VerifyOrReturnError(!handle.IsNull(), CHIP_ERROR_NO_MEMORY);
131132

132133
System::PacketBufferTLVWriter writer;
133134
writer.Init(std::move(handle), false);

src/protocols/secure_channel/PairingSession.h

+4-1
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,10 @@ class DLL_EXPORT PairingSession : public SessionDelegate
142142

143143
Protocols::SecureChannel::StatusReport statusReport(generalCode, Protocols::SecureChannel::Id, protocolCode);
144144

145-
Encoding::LittleEndian::PacketBufferWriter bbuf(System::PacketBufferHandle::New(statusReport.Size()));
145+
auto handle = System::PacketBufferHandle::New(statusReport.Size());
146+
VerifyOrReturn(!handle.IsNull(), ChipLogError(SecureChannel, "Failed to allocate status report message"));
147+
Encoding::LittleEndian::PacketBufferWriter bbuf(std::move(handle));
148+
146149
statusReport.WriteToBuffer(bbuf);
147150

148151
System::PacketBufferHandle msg = bbuf.Finalize();

src/setup_payload/AdditionalDataPayloadGenerator.cpp

+3-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,9 @@ AdditionalDataPayloadGenerator::generateAdditionalDataPayload(AdditionalDataPayl
5353
TLVWriter innerWriter;
5454

5555
// Initialize TLVWriter
56-
writer.Init(chip::System::PacketBufferHandle::New(chip::System::PacketBuffer::kMaxSize));
56+
auto tempBuffer = chip::System::PacketBufferHandle::New(chip::System::PacketBuffer::kMaxSize);
57+
VerifyOrReturnError(!tempBuffer.IsNull(), CHIP_ERROR_NO_MEMORY);
58+
writer.Init(std::move(tempBuffer));
5759

5860
ReturnErrorOnFailure(writer.OpenContainer(AnonymousTag(), kTLVType_Structure, innerWriter));
5961

0 commit comments

Comments
 (0)