Merge pull request #76 from Componolit/issue_75

Add reproducer for issue 75

Author: senier

.gitignore

@@ -0,0 +1 @@
+obj

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "examples/contrib/FreeRTOS-Plus-TCP"]
+	path = examples/contrib/FreeRTOS-Plus-TCP
+	url = https://github.com/FreeRTOS/FreeRTOS-Plus-TCP.git

examples/Makefile

@@ -0,0 +1,42 @@
+COMMON_CFLAGS = -g -Wno-pointer-to-int-cast -Dstatic= -fsanitize=address 
+LDFLAGS = -lasan
+
+FREERTOS_PLUS_TCP_PATH = contrib/FreeRTOS-Plus-TCP
+
+VPATH += src $(FREERTOS_PLUS_TCP_PATH) $(FREERTOS_PLUS_TCP_PATH)/portable/BufferManagement
+
+DUMMY := $(shell mkdir -p obj)
+VERBOSE ?= @
+
+VULNS = vuln_75
+
+all: $(addprefix obj/,$(VULNS))
+	$(VERBOSE)for t in $<; do echo "Running $$t"; ./$$t; done
+
+obj/vuln_75: \
+	obj/FreeRTOS_ARP.o \
+	obj/FreeRTOS_DHCP.o \
+	obj/FreeRTOS_IP.o \
+	obj/FreeRTOS_UDP_IP.o \
+	obj/FreeRTOS_Sockets.o \
+	obj/BufferAllocation_1.o \
+	obj/freertos_10_0_1_helper.o \
+	obj/list.o \
+	obj/port.o \
+	obj/queue.o \
+	obj/vuln_75.o
+obj/vuln_75: \
+	CFLAGS += \
+		-Iinclude/FreeRTOS-10.0.1 \
+		-I$(FREERTOS_PLUS_TCP_PATH) \
+		-I$(FREERTOS_PLUS_TCP_PATH)/include \
+		-I$(FREERTOS_PLUS_TCP_PATH)/portable/Compiler/GCC \
+		$(COMMON_CFLAGS)
+obj/vuln_75:
+	$(VERBOSE)$(CC) $(LDFLAGS) -o $@ -Wl,--start-group $^ -Wl,--end-group
+
+obj/%.o: %.c
+	$(VERBOSE)$(CC) $(CFLAGS) -o $@ -c $<
+
+clean:
+	$(VERBOE)rm -rf obj

examples/contrib/FreeRTOS-Plus-TCP

@@ -0,0 +1,21 @@
+#ifndef INC_FREERTOS_H
+#define INC_FREERTOS_H
+
+#include <stddef.h>
+
+#define pdMS_TO_TICKS( xTimeInMs ) 0
+
+#include <list.h>
+#include <queue.h>
+
+#define pdFALSE 0
+#define pdTRUE 1
+
+#define configASSERT(x)
+
+typedef int32_t BaseType_t;
+typedef uint32_t UBaseType_t;
+typedef uint32_t TickType_t;
+typedef uint32_t TimeOut_t;
+
+#endif // INC_FREERTOS_H

examples/include/FreeRTOS-10.0.1.old/FreeRTOS.h

@@ -0,0 +1,25 @@
+#ifndef FREERTOS_IP_CONFIG_H
+#define FREERTOS_IP_CONFIG_H
+
+#define ipconfigNETWORK_MTU 1500
+
+#define ipconfigNUM_NETWORK_BUFFER_DESCRIPTORS 1
+#define ipconfigEVENT_QUEUE_LENGTH 6
+
+#define ipconfigUSE_TCP 0
+#define ipconfigUSE_TCP_WIN 0
+#define ipconfigUSE_LINKED_RX_MESSAGES 0
+#define ipconfigMAX_IP_TASK_SLEEP_TIME 0
+#define ipconfigIP_TASK_PRIORITY 0
+#define ipconfigIP_TASK_STACK_SIZE_WORDS 100
+#define ipconfigUDP_MAX_SEND_BLOCK_TIME_TICKS 1000
+
+#define ipconfigUSE_DHCP 1
+#define ipconfigUSE_DNS 0
+
+#define ipconfigRAND32() 42
+
+#define portMAX_DELAY 0
+#define configTICK_RATE_HZ 1000
+
+#endif // !FREERTOS_IP_CONFIG_H

examples/include/FreeRTOS-10.0.1.old/FreeRTOSIPConfig.h

@@ -0,0 +1,6 @@
+#pragma once
+
+typedef uint64_t EventBits_t;
+typedef uint64_t EventGroupHandle_t;
+
+#define xEventGroupSetBits(x, y)

examples/include/FreeRTOS-10.0.1.old/event_groups.h

@@ -0,0 +1,6 @@
+#pragma once
+
+typedef uint64_t ListItem_t;
+typedef uint64_t List_t;
+
+#define vListInsertEnd(x, y)

examples/include/FreeRTOS-10.0.1.old/list.h

@@ -0,0 +1,16 @@
+#ifndef INC_QUEUE_H
+#define INC_QUEUE_H
+
+#define pdFAIL pdFALSE
+#define pdPASS pdTRUE
+
+typedef uint64_t xQueueItem;
+typedef uint64_t *QueueHandle_t;
+
+#define xQueueReceive(a, b, c)
+#define xQueueSendToBack(a, b, c) pdPASS
+#define xQueueSendToBackFromISR(a, b, c) pdPASS
+#define vQueueDelete(q)
+#define xQueueCreate(a, b) NULL
+
+#endif // INC_QUEUE_H