#1433·FreeRTOS

[BUG] task-stats sample overflow its output buffer as the application task set grows

Author: Arslan8Created Aug 29, 2026Updated Aug 30, 2026
Labelsbug

Describe the bug

The sample task-stats command in FreeRTOS-Plus/Demo/Common/FreeRTOS_Plus_CLI_Demos/Sample-CLI-commands.c ignores the xWriteBufferLen argument supplied to prvTaskStatsCommand().

The command writes its header to pcWriteBuffer and then appends the task table using vTaskList() without checking how much space remains in the caller-provided output buffer. As a result, when the sample is adapted to an application with enough tasks for the generated task-statistics table to exceed the fixed CLI output buffer, prvTaskStatsCommand() can write past the end of pcWriteBuffer.

The issue is present on the current main revision.

Target

  • Development board: Not hardware-specific
  • Instruction Set Architecture: Not architecture-specific
  • IDE and version: N/A
  • Toolchain and version: N/A

Host

  • Host OS: N/A
  • Version: N/A

To Reproduce

  • Build an application using the sample CLI commands from FreeRTOS-Plus/Demo/Common/FreeRTOS_Plus_CLI_Demos/Sample-CLI-commands.c.
  • Register the commands using vRegisterSampleCLICommands().
  • Use a fixed-size output buffer with FreeRTOS_CLIProcessCommand().
  • Create enough FreeRTOS tasks such that the output generated by task-stats is larger than the CLI output buffer.
  • Execute the task-stats command.
  • prvTaskStatsCommand() appends the output of vTaskList() without respecting xWriteBufferLen, causing a write beyond the end of the supplied buffer.

Expected behavior

prvTaskStatsCommand() should respect xWriteBufferLen and ensure that the task-statistics output does not exceed the caller-provided output buffer.

Screenshots

N/A

Additional context

The callback currently explicitly ignores the supplied buffer length:

c
( void ) xWriteBufferLen;

/* ... construct header ... */

strcpy( pcWriteBuffer, pcHeader );
vTaskList( pcWriteBuffer + strlen( pcHeader ) );

Current FreeRTOS provides the length-aware vTaskListTasks() API. Since prvTaskStatsCommand() already receives xWriteBufferLen, the sample could use bounded header construction and pass the remaining capacity to vTaskListTasks().

For example:

c
size_t header_len = snprintf(
    pcWriteBuffer,
    xWriteBufferLen,
    "Task ...\r\n"
);

if( header_len < xWriteBufferLen )
{
    vTaskListTasks(
        pcWriteBuffer + header_len,
        xWriteBufferLen - header_len
    );
}

This would allow the sample to respect the caller-provided buffer length and avoid an out-of-bounds write as the number of application tasks grows.