[BUG] task-stats sample overflow its output buffer as the application task set grows
Describe the bug
The sample task-stats command in FreeRTOS-Plus/Demo/Common/FreeRTOS_Plus_CLI_Demos/Sample-CLI-commands.c ignores the xWriteBufferLen argument supplied to prvTaskStatsCommand().
The command writes its header to pcWriteBuffer and then appends the task table using vTaskList() without checking how much space remains in the caller-provided output buffer. As a result, when the sample is adapted to an application with enough tasks for the generated task-statistics table to exceed the fixed CLI output buffer, prvTaskStatsCommand() can write past the end of pcWriteBuffer.
The issue is present on the current main revision.
Target
- Development board: Not hardware-specific
- Instruction Set Architecture: Not architecture-specific
- IDE and version: N/A
- Toolchain and version: N/A
Host
- Host OS: N/A
- Version: N/A
To Reproduce
- Build an application using the sample CLI commands from
FreeRTOS-Plus/Demo/Common/FreeRTOS_Plus_CLI_Demos/Sample-CLI-commands.c. - Register the commands using
vRegisterSampleCLICommands(). - Use a fixed-size output buffer with
FreeRTOS_CLIProcessCommand(). - Create enough FreeRTOS tasks such that the output generated by
task-statsis larger than the CLI output buffer. - Execute the
task-statscommand. prvTaskStatsCommand()appends the output ofvTaskList()without respectingxWriteBufferLen, causing a write beyond the end of the supplied buffer.
Expected behavior
prvTaskStatsCommand() should respect xWriteBufferLen and ensure that the task-statistics output does not exceed the caller-provided output buffer.
Screenshots
N/A
Additional context
The callback currently explicitly ignores the supplied buffer length:
( void ) xWriteBufferLen;
/* ... construct header ... */
strcpy( pcWriteBuffer, pcHeader );
vTaskList( pcWriteBuffer + strlen( pcHeader ) );Current FreeRTOS provides the length-aware vTaskListTasks() API. Since prvTaskStatsCommand() already receives xWriteBufferLen, the sample could use bounded header construction and pass the remaining capacity to vTaskListTasks().
For example:
size_t header_len = snprintf(
pcWriteBuffer,
xWriteBufferLen,
"Task ...\r\n"
);
if( header_len < xWriteBufferLen )
{
vTaskListTasks(
pcWriteBuffer + header_len,
xWriteBufferLen - header_len
);
}This would allow the sample to respect the caller-provided buffer length and avoid an out-of-bounds write as the number of application tasks grows.
Source: FreeRTOS/FreeRTOS