(nuttx) branch master updated: sched/irq: Avoid negative array index in irqchain_dispatch

[xiaoxiang]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 927cccb2785 sched/irq: Avoid negative array index in irqchain_dispatch
927cccb2785 is described below

commit 927cccb278538ebe58c8618ae0d26e38a373dc74
Author: pangzhen1 <pangzh...@xiaomi.com>
AuthorDate: Tue Sep 2 20:56:00 2025 +0800

    sched/irq: Avoid negative array index in irqchain_dispatch
    
    IRQ_TO_NDX() may return a negative value when the IRQ number is invalid
    or not mapped. Using this negative value directly as an array index for
    g_irqvector causes undefined behavior and potential memory corruption.
    
    This patch adds a bounds check to ensure ndx is non-negative before
    accessing the g_irqvector array, returning the error code if invalid.
    
    Signed-off-by: pangzhen1 <pangzh...@xiaomi.com>
---
 sched/irq/irq_chain.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/sched/irq/irq_chain.c b/sched/irq/irq_chain.c
index d2eed6f9778..76c6e94b331 100644
--- a/sched/irq/irq_chain.c
+++ b/sched/irq/irq_chain.c
@@ -80,12 +80,19 @@ static int irqchain_dispatch(int irq, FAR void *context, 
FAR void *arg)
   int ndx = IRQ_TO_NDX(irq);
   int ret = 0;
 
-  curr = g_irqvector[ndx].arg;
-  while (curr != NULL)
+  if (ndx < 0)
     {
-      prev = curr;
-      curr = curr->next;
-      ret |= prev->handler(irq, context, prev->arg);
+      ret = ndx;
+    }
+  else
+    {
+      curr = g_irqvector[ndx].arg;
+      while (curr != NULL)
+        {
+          prev = curr;
+          curr = curr->next;
+          ret |= prev->handler(irq, context, prev->arg);
+        }
     }
 
   return ret;