ArduPilot / ArduPilot/ardupilot
Possible NULL pointer dereference in libraries/AP_RangeFinder/AP_RangeFinder_BBB_PRU.cpp
- Dominant language
- C++
- Stars
- 15.9k
- Forks
- 21.4k
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 119
Description
### Bug report
**Issue details**
At line 73, 78, 91, and 96 in ardupilot-master/libraries/AP_RangeFinder/AP_RangeFinder_BBB_PRU.cpp, *file* can be null pointer dereference.
If it fails to open the file, *fread()* and *fclose()* can be NULL pointer dereference.
I think that it is better to check whether *file* is null pointer or not.
---------- Original source code ----------
```
// Load firmware (.text)
FILE *file = fopen("/lib/firmware/rangefinderprutext.bin", "rb");
if(file == nullptr)
{
result = false;
}
if(fread(ram, PRU0_IRAM_SIZE, 1, file) != 1) // here
{
result = false;
}
fclose(file); // here
munmap(ram, PRU0_IRAM_SIZE);
ram = mmap(0, PRU0_DRAM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, mem_fd, PRU0_DRAM_BASE);
// Load firmware (.data)
file = fopen("/lib/firmware/rangefinderprudata.bin", "rb");
if(file == nullptr)
{
result = false;
}
if(fread(ram, PRU0_DRAM_SIZE, 1, file) != 1) // here
{
result = false;
}
fclose(file); // here
```
**Version**
ardupilot master
**Platform**
[V] All
[ ] AntennaTracker
[ ] Copter
[ ] Plane
[ ] Rover
[ ] Submarine
**Airframe type**
**Hardware type**
**Logs**
Contributor guide
Research direction
Start by reading libraries/AP_RangeFinder/AP_RangeFinder_BBB_PRU.cpp at the reported lines and trace both firmware-loading fopen calls. Confirm that failed file opens cannot reach fread or fclose, and verify the rangefinder build or relevant existing tests if available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- embedded-iot
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100