Fix bad-free when receiving malformed DATA_FRAG submessage (#4145) (#…

…4147) * Refs #20140: Add regression test Signed-off-by: EduPonz <eduardoponz@eprosima.com> * Refs #20140: Fix bad free Signed-off-by: EduPonz <eduardoponz@eprosima.com> --------- Signed-off-by: EduPonz <eduardoponz@eprosima.com> (cherry picked from commit 7157a19) Co-authored-by: Eduardo Ponz Segrelles <eduardoponz@eprosima.com>
eProsima · Dec 18, 2023 · ce877eb · ce877eb
1 parent 8f48bbc
commit ce877eb
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/src/cpp/rtps/messages/MessageReceiver.cpp b/src/cpp/rtps/messages/MessageReceiver.cpp
@@ -1046,6 +1046,8 @@ bool MessageReceiver::proc_Submsg_DataFrag(
         {
             EPROSIMA_LOG_WARNING(RTPS_MSG_IN, IDSTRING "Serialized Payload value invalid or larger than maximum allowed size "
                     "(" << payload_size << "/" << (msg->length - msg->pos) << ")");
+            ch.serializedPayload.data = nullptr;
+            ch.inline_qos.data = nullptr;
             return false;
         }
     }

diff --git a/test/blackbox/common/BlackboxTestsTransportUDP.cpp b/test/blackbox/common/BlackboxTestsTransportUDP.cpp
@@ -548,6 +548,7 @@ TEST(TransportUDP, DatagramInjection)
     ASSERT_FALSE(receivers.empty());
 
     deliver_datagram_from_file(receivers, "datagrams/16784.bin");
+    deliver_datagram_from_file(receivers, "datagrams/20140.bin");
 }
 
 // Test for ==operator UDPTransportDescriptor is not required as it is an abstract class and in UDPv4 is same method

diff --git a/test/blackbox/datagrams/20140.bin b/test/blackbox/datagrams/20140.bin