Skip to content

demo: fix stack corruption in ping_pong demo#96

Open
corytodd wants to merge 1 commit intomicro-ROS:kiltedfrom
corytodd:fix-ping-pong-stack-corruption
Open

demo: fix stack corruption in ping_pong demo#96
corytodd wants to merge 1 commit intomicro-ROS:kiltedfrom
corytodd:fix-ping-pong-stack-corruption

Conversation

@corytodd
Copy link
Copy Markdown

@corytodd corytodd commented Apr 3, 2026

While running the ping_pong demo I noticed a crash:

ping_pong_1-1 | [ros2run]: Aborted
ping_pong_1-1 | [INFO] [1775242528.757714440] []: Created a timer with period 2000 ms. ping_pong_1-1 |
ping_pong_2-1 | realloc(): invalid old size
ping_pong_1-1 | mremap_chunk(): invalid pointer
ping_pong_2-1 | [ros2run]: Aborted
ping_pong_1-1 | [ros2run]: Aborted

This is caused by stack memory being passed to realloc() at https://github.com/ros2/rosidl/blob/8cdfe315157f8bffa9b73b6750c52f44325a7847/rosidl_runtime_c/src/string_functions.c#L110

Use ros string allocators to handle this safely. The outcoming_ping is sprintf'd so we must preallocate.

After patching my tree I see the expected output

subscriber-1  | Pong for seq 1308616470_783094776 (1)
publisher-1   | Ping received with seq 1308616470_783094776. Answering.
publisher-1   | Ping send seq 1267638503_591265725
subscriber-1  | Ping received with seq 1267638503_591265725. Answering.
publisher-1   | Pong for seq 1267638503_591265725 (1)
subscriber-1  | Ping send seq 1379001663_783094776
publisher-1   | Ping received with seq 1379001663_783094776. Answering.

Fixes #95

Signed-off-by: Cory Todd [email protected]

While running the ping_pong demo I noticed a crash:

ping_pong_1-1  | [ros2run]: Aborted
ping_pong_1-1  | [INFO] [1775242528.757714440] []: Created a timer with period 2000 ms.
ping_pong_1-1  |
ping_pong_2-1  | realloc(): invalid old size
ping_pong_1-1  | mremap_chunk(): invalid pointer
ping_pong_2-1  | [ros2run]: Aborted
ping_pong_1-1  | [ros2run]: Aborted

This is caused by stack memory being passed to realloc() at
https://github.com/ros2/rosidl/blob/8cdfe315157f8bffa9b73b6750c52f44325a7847/rosidl_runtime_c/src/string_functions.c#L110

Use ros string allocators to handle this safely. The outcoming_ping
is sprintf'd so we must preallocate.

Signed-off-by: Cory Todd <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ping_pong demo segfault

1 participant