Repository navigation
[BUG] erpcgen C++ list decoder dereferences NULL after allocation failure #485
Description
Describe the bug
The C++ read_list_uint8_1_t_struct code generated by erpcgen can dereference a null pointer when erpc_malloc() fails while decoding a non-empty list.
Codec::updateStatus() only records the error; it does not short-circuit the method. The list decoder therefore continues to its element loop and indexes the failed allocation.
To Reproduce (Example)
server.cpp
// Read struct list_uint8_1_t function implementation
static void read_list_uint8_1_t_struct(erpc::Codec * codec, list_uint8_1_t * data)
{
if(NULL == data)
{
return;
}
codec->startReadList(data->elementsCount);
data->elements = (uint8_t *) erpc_malloc(data->elementsCount * sizeof(uint8_t));
if ((data->elements == NULL) && (data->elementsCount > 0))
{
codec->updateStatus(kErpcStatus_MemoryError);
// No exit <<<----------------------
}
for (uint32_t listCount = 0U; listCount < data->elementsCount; ++listCount)
{
codec->read(data->elements[listCount]);
}
}
eRPC Version: 1.13.0
Steps you didn't forgot to do
- I checked if there is no related issue opened/closed.
- I checked that there doesn't exist opened PR which is solving this issue.
Activity
github-actions commentedon Sep 1, 2026
Hi eRPC user. Thank you for your interest and welcome. We hope you will enjoy this framework well.