Skip to content

Handle descriptor-only file packets as off-nominal input - #2

Closed
bitWarrior wants to merge 1 commit into
develfrom
fix/empty-file-packet-assert
Closed

bitWarrior wants to merge 1 commit into
develfrom
fix/empty-file-packet-assert

Conversation

@bitWarrior

Copy link
Copy Markdown
Owner

Summary

Resolves an off-nominal condition in file packet ingest. A packet consisting of only the 2-byte FW_PACKET_FILE descriptor with no body passed the minimum-size guards in FileUplink and CfdpManager, which then built a zero-length Fw::Buffer over a valid pointer. Since the LinearBufferBase refactor, its constructor required a null pointer whenever capacity is zero, so this input tripped an assertion rather than being reported as a decode error.

Changes

  • Fw/Types/Serializable.cpp: LinearBufferBase now accepts a valid pointer with zero capacity. This matches the existing contract of ExternalSerializeBuffer::setExtBuffer and restores the behavior from before the refactor. A null pointer with nonzero capacity still asserts.
  • Svc/FileUplink/FileUplink.cpp: the size guard rejects packets that carry no bytes after the descriptor, logging InvalidPacketReceived as it does for shorter packets.
  • Svc/Ccsds/CfdpManager/CfdpManager.cpp: the same boundary check on dataIn, returning the buffer silently as the existing too-small path does.

The constructor change is the root fix. The two guard changes are defense in depth so neither component depends on the buffer contract for this case.

Tests

  • Fw_Types_ut_exe: zero-capacity ExternalSerializeBuffer and SerialBuffer over a valid pointer construct cleanly and report the expected statuses. Null with zero capacity still works. Null with nonzero capacity still asserts (death test).
  • Svc_FileUplink_ut_exe: 1-byte, 2-byte descriptor-only, and 3-byte truncated-body packets each return the buffer and emit exactly one warning event.
  • Svc_Ccsds_CfdpManager_ut_exe: 2-byte descriptor-only packet returns the buffer with no events. 3-byte control reaches the engine and reports a header deserialization failure.

All three suites pass (68, 15 and 195 tests). With the source changes reverted, the new 2-byte tests in both components abort at the assertion, confirming they exercise the reported path.

🤖 Generated with Claude Code

A file packet consisting of only the FW_PACKET_FILE descriptor with no
body passed the minimum-size guards in FileUplink and CfdpManager, which
then built a zero-length buffer over a valid pointer. Since the
LinearBufferBase refactor, its constructor required a null pointer
whenever capacity is zero, so this input tripped an assertion instead of
being reported as a decode error.

- Fw/Types: LinearBufferBase accepts a valid pointer with zero capacity,
  matching ExternalSerializeBuffer::setExtBuffer and prior behavior. A
  null pointer with nonzero capacity still asserts.
- Svc/FileUplink: reject packets that carry no bytes after the
  descriptor, logging InvalidPacketReceived as for shorter packets.
- Svc/Ccsds/CfdpManager: same boundary check on dataIn.

Tests cover zero-capacity buffers at the Fw/Types level and 1-, 2- and
3-byte packets for both components.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@bitWarrior

Copy link
Copy Markdown
Owner Author

Retargeting this to nasa/fprime.

@bitWarrior bitWarrior closed this Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant