This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit b23b49eedf03b9ad2d0050125d10bcfde018274c Author: Marco Casaroli <[email protected]> AuthorDate: Tue Oct 20 20:30:00 2026 +0200 sched/task: Fail with E2BIG when the arguments do not fit the stack. nxtask_setup_stackargs() copies the arguments to the stack of the new task. When they did not fit, a DEBUGASSERT stopped the system, which a program can cause with a long argument. Without assertions the loop set -ENAMETOOLONG but did not advance, so it never ended. The check of CONFIG_TASK_MAX_ARGS did not end the loop either. Strings that fit but leave no room for the argv[] array made up_stack_frame() fail, and a DEBUGASSERT stopped the system there too. Now both checks end the loop with E2BIG, the error that POSIX gives exec for an argument list that is too large, and a failed up_stack_frame() gives E2BIG too. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <[email protected]> --- sched/task/task_setup.c | 32 ++++++++++---------------------- 1 file changed, 10 insertions(+), 22 deletions(-) diff --git a/sched/task/task_setup.c b/sched/task/task_setup.c index 72eb2f10d49..82c2802c3e6 100644 --- a/sched/task/task_setup.c +++ b/sched/task/task_setup.c @@ -548,30 +548,17 @@ int nxtask_setup_stackargs(FAR struct tcb_s *tcb, while (argv[argc]) { - /* Add the size of this argument (with NUL terminator). - * Check each time if the accumulated size exceeds the - * size of the allocated stack. + /* Add the size of this argument (with NUL terminator). The + * arguments must fit in the stack, and there may be at most + * CONFIG_TASK_MAX_ARGS of them. */ strtablen += (strlen(argv[argc]) + 1); - DEBUGASSERT(strtablen < tcb->adj_stack_size); - if (strtablen >= tcb->adj_stack_size) + if (strtablen >= tcb->adj_stack_size || + ++argc > CONFIG_TASK_MAX_ARGS) { - ret = -ENAMETOOLONG; - } - else - { - /* Increment the number of args. Here is a sanity check to - * prevent running away with an unterminated argv[] list. - * CONFIG_TASK_MAX_ARGS should be sufficiently large that this - * never happens in normal usage. - */ - - DEBUGASSERT(argc <= CONFIG_TASK_MAX_ARGS); - if (++argc > CONFIG_TASK_MAX_ARGS) - { - ret = -E2BIG; - } + ret = -E2BIG; + break; } } } @@ -586,10 +573,11 @@ int nxtask_setup_stackargs(FAR struct tcb_s *tcb, argvlen = (argc + 2) * sizeof(FAR char *); stackargv = (FAR char **)up_stack_frame(tcb, argvlen + strtablen); - DEBUGASSERT(stackargv != NULL); + /* It fails when the argv[] array and the strings do not fit */ + if (stackargv == NULL) { - ret = -ENOMEM; + ret = -E2BIG; } else {
