Repository navigation
[libc] fix: bounds-check timer id in timer_gettime/settime - #11997
BernardXiong wants to merge 1 commit into
Conversation
timer_gettime() and timer_settime() indexed _g_timerid[] with the raw timer_t value, unlike timer_delete(). Reject ids >= TIMER_ID_MAX before the lookup to keep the table access in bounds.
|
👋 感谢您对 RT-Thread 的贡献!Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范,请在你的仓库中执行以下步骤运行代码格式化工作流(如果格式化CI运行失败)。 🛠 操作步骤 | Steps
完成后,提交将自动更新至 如有问题欢迎联系我们,再次感谢您的贡献!💐 |
📌 Code Review Assignment🏷️ Tag: componentsReviewers: @Maihuanyi Changed Files (Click to expand)
🏷️ Tag: components_libcReviewers: @GorrayLi @mysterywolf Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-11-07 03:05 CST)
📝 Review Instructions
|
|
Summary
timer_gettime()andtimer_settime()used the caller-suppliedtimer_tdirectly as an index into_g_timerid[TIMER_ID_MAX].timer_delete()already validates the same id range; this brings the sibling paths in line.Fixes #11980.
Change
Before indexing
_g_timerid[], reject ids>= TIMER_ID_MAXwithEINVALin:timer_gettime()timer_settime()Validation
bsp/simulatorwithRT_USING_POSIX_TIMER=y: the POSIX timer block is active and the modifiedctime.cpasses a syntax check with no errors. A full simulator link is not possible in this environment because enabling POSIX timers collides with the hostsignal.h/time.h definitions (pre-existing host-port issue); the change itself introduces no new diagnostics compared with the unmodified file.Note
#11938 touches the same functions for 64-bit truncation but does not validate the id; whichever lands second may need a trivial rebase.