Fix bad-free when receiving malformed DATA_FRAG submessage (#4145)

* Refs #20140: Add regression test Signed-off-by: EduPonz <eduardoponz@eprosima.com> * Refs #20140: Fix bad free Signed-off-by: EduPonz <eduardoponz@eprosima.com> --------- Signed-off-by: EduPonz <eduardoponz@eprosima.com>
eProsima · Dec 16, 2023 · 7157a19 · 7157a19
1 parent 25dee05
commit 7157a19
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/src/cpp/rtps/messages/MessageReceiver.cpp b/src/cpp/rtps/messages/MessageReceiver.cpp
@@ -1047,6 +1047,8 @@ bool MessageReceiver::proc_Submsg_DataFrag(
         {
             EPROSIMA_LOG_WARNING(RTPS_MSG_IN, IDSTRING "Serialized Payload value invalid or larger than maximum allowed size "
                     "(" << payload_size << "/" << (msg->length - msg->pos) << ")");
+            ch.serializedPayload.data = nullptr;
+            ch.inline_qos.data = nullptr;
             return false;
         }
     }

diff --git a/test/blackbox/common/BlackboxTestsTransportUDP.cpp b/test/blackbox/common/BlackboxTestsTransportUDP.cpp
@@ -552,6 +552,7 @@ TEST(TransportUDP, DatagramInjection)
     ASSERT_FALSE(receivers.empty());
 
     deliver_datagram_from_file(receivers, "datagrams/16784.bin");
+    deliver_datagram_from_file(receivers, "datagrams/20140.bin");
 }
 
 // Test for ==operator UDPTransportDescriptor is not required as it is an abstract class and in UDPv4 is same method

diff --git a/test/blackbox/datagrams/20140.bin b/test/blackbox/datagrams/20140.bin