Add reproducer for issue 75

Author: Alexander Senier

.gitignore

@@ -0,0 +1 @@
+obj

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "examples/contrib/FreeRTOS-Plus-TCP"]
+	path = examples/contrib/FreeRTOS-Plus-TCP
+	url = https://github.com/FreeRTOS/FreeRTOS-Plus-TCP.git

examples/Makefile

@@ -0,0 +1,42 @@
+COMMON_CFLAGS = -g -Wno-pointer-to-int-cast -Dstatic= -fsanitize=address 
+LDFLAGS = -lasan
+
+FREERTOS_PLUS_TCP_PATH = contrib/FreeRTOS-Plus-TCP
+
+VPATH += src $(FREERTOS_PLUS_TCP_PATH) $(FREERTOS_PLUS_TCP_PATH)/portable/BufferManagement
+
+DUMMY := $(shell mkdir -p obj)
+VERBOSE ?= @
+
+VULNS = vuln_75
+
+all: $(addprefix obj/,$(VULNS))
+	$(VERBOSE)for t in $<; do echo "Running $$t"; ./$$t; done
+
+obj/vuln_75: \
+	obj/FreeRTOS_ARP.o \
+	obj/FreeRTOS_DHCP.o \
+	obj/FreeRTOS_IP.o \
+	obj/FreeRTOS_UDP_IP.o \
+	obj/FreeRTOS_Sockets.o \
+	obj/BufferAllocation_1.o \
+	obj/freertos_10_0_1_helper.o \
+	obj/list.o \
+	obj/port.o \
+	obj/queue.o \
+	obj/vuln_75.o
+obj/vuln_75: \
+	CFLAGS += \
+		-Iinclude/FreeRTOS-10.0.1 \
+		-I$(FREERTOS_PLUS_TCP_PATH) \
+		-I$(FREERTOS_PLUS_TCP_PATH)/include \
+		-I$(FREERTOS_PLUS_TCP_PATH)/portable/Compiler/GCC \
+		$(COMMON_CFLAGS)
+obj/vuln_75:
+	$(VERBOSE)$(CC) $(LDFLAGS) -o $@ -Wl,--start-group $^ -Wl,--end-group
+
+obj/%.o: %.c
+	$(VERBOSE)$(CC) $(CFLAGS) -o $@ -c $<
+
+clean:
+	$(VERBOE)rm -rf obj

examples/contrib/FreeRTOS-Plus-TCP

@@ -0,0 +1,21 @@
+#ifndef INC_FREERTOS_H
+#define INC_FREERTOS_H
+
+#include <stddef.h>
+
+#define pdMS_TO_TICKS( xTimeInMs ) 0
+
+#include <list.h>
+#include <queue.h>
+
+#define pdFALSE 0
+#define pdTRUE 1
+
+#define configASSERT(x)
+
+typedef int32_t BaseType_t;
+typedef uint32_t UBaseType_t;
+typedef uint32_t TickType_t;
+typedef uint32_t TimeOut_t;
+
+#endif // INC_FREERTOS_H

examples/include/FreeRTOS-10.0.1.old/FreeRTOS.h

@@ -0,0 +1,25 @@
+#ifndef FREERTOS_IP_CONFIG_H
+#define FREERTOS_IP_CONFIG_H
+
+#define ipconfigNETWORK_MTU 1500
+
+#define ipconfigNUM_NETWORK_BUFFER_DESCRIPTORS 1
+#define ipconfigEVENT_QUEUE_LENGTH 6
+
+#define ipconfigUSE_TCP 0
+#define ipconfigUSE_TCP_WIN 0
+#define ipconfigUSE_LINKED_RX_MESSAGES 0
+#define ipconfigMAX_IP_TASK_SLEEP_TIME 0
+#define ipconfigIP_TASK_PRIORITY 0
+#define ipconfigIP_TASK_STACK_SIZE_WORDS 100
+#define ipconfigUDP_MAX_SEND_BLOCK_TIME_TICKS 1000
+
+#define ipconfigUSE_DHCP 1
+#define ipconfigUSE_DNS 0
+
+#define ipconfigRAND32() 42
+
+#define portMAX_DELAY 0
+#define configTICK_RATE_HZ 1000
+
+#endif // !FREERTOS_IP_CONFIG_H

examples/include/FreeRTOS-10.0.1.old/FreeRTOSIPConfig.h

@@ -0,0 +1,6 @@
+#pragma once
+
+typedef uint64_t EventBits_t;
+typedef uint64_t EventGroupHandle_t;
+
+#define xEventGroupSetBits(x, y)

examples/include/FreeRTOS-10.0.1.old/event_groups.h

@@ -0,0 +1,6 @@
+#pragma once
+
+typedef uint64_t ListItem_t;
+typedef uint64_t List_t;
+
+#define vListInsertEnd(x, y)

examples/include/FreeRTOS-10.0.1.old/list.h

@@ -0,0 +1,16 @@
+#ifndef INC_QUEUE_H
+#define INC_QUEUE_H
+
+#define pdFAIL pdFALSE
+#define pdPASS pdTRUE
+
+typedef uint64_t xQueueItem;
+typedef uint64_t *QueueHandle_t;
+
+#define xQueueReceive(a, b, c)
+#define xQueueSendToBack(a, b, c) pdPASS
+#define xQueueSendToBackFromISR(a, b, c) pdPASS
+#define vQueueDelete(q)
+#define xQueueCreate(a, b) NULL
+
+#endif // INC_QUEUE_H

examples/include/FreeRTOS-10.0.1.old/queue.h

@@ -0,0 +1,19 @@
+#ifndef INC_TASK_H
+#define INC_TASK_H
+
+#include <FreeRTOS.h>
+
+typedef uint64_t* TaskHandle_t;
+
+#define xTaskGetCurrentTaskHandle() NULL
+#define xTaskGetTickCount() 0
+#define vTaskSetTimeOutState(t)
+#define vTaskDelay(d)
+#define xTaskCheckForTimeOut(t, x) pdFALSE
+#define xTaskCreate(a, b, c, d, e, f) 0
+#define xTaskResumeAll()
+#define vTaskSuspendAll()
+#define taskENTER_CRITICAL()
+#define taskEXIT_CRITICAL()
+
+#endif // INC_TASK_H

examples/include/FreeRTOS-10.0.1.old/semphr.h

@@ -0,0 +1,67 @@
+#ifndef INC_FREERTOS_H
+#define INC_FREERTOS_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "FreeRTOSConfig.h"
+#include "projdefs.h"
+#include "portable.h"
+
+typedef uint64_t TickType_t;
+typedef unsigned long UBaseType_t;
+typedef long BaseType_t;
+
+#define configASSERT(x)
+#define PRIVILEGED_FUNCTION
+
+#define mtCOVERAGE_TEST_DELAY()
+#define mtCOVERAGE_TEST_MARKER()
+
+struct xSTATIC_MINI_LIST_ITEM
+{
+	TickType_t xDummy1;
+	void *pvDummy2[ 2 ];
+};
+typedef struct xSTATIC_MINI_LIST_ITEM StaticMiniListItem_t;
+
+typedef struct xSTATIC_LIST
+{
+	UBaseType_t uxDummy1;
+	void *pvDummy2;
+	StaticMiniListItem_t xDummy3;
+} StaticList_t;
+
+typedef struct xSTATIC_QUEUE
+{
+	void *pvDummy1[ 3 ];
+
+	union
+	{
+		void *pvDummy2;
+		UBaseType_t uxDummy2;
+	} u;
+
+	StaticList_t xDummy3[ 2 ];
+	UBaseType_t uxDummy4[ 3 ];
+	uint8_t ucDummy5[ 2 ];
+
+	#if( ( configSUPPORT_STATIC_ALLOCATION == 1 ) && ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) )
+		uint8_t ucDummy6;
+	#endif
+
+	#if ( configUSE_QUEUE_SETS == 1 )
+		void *pvDummy7;
+	#endif
+
+	#if ( configUSE_TRACE_FACILITY == 1 )
+		UBaseType_t uxDummy8;
+		uint8_t ucDummy9;
+	#endif
+
+} StaticQueue_t;
+
+#define portSET_INTERRUPT_MASK_FROM_ISR() 0
+#define portCLEAR_INTERRUPT_MASK_FROM_ISR( uxSavedStatusValue ) ( void ) uxSavedStatusValue
+
+#endif // !INC_FREERTOS_H

examples/include/FreeRTOS-10.0.1.old/task.h

@@ -0,0 +1,7 @@
+#ifndef FREERTOS_CONFIG_H
+#define FREERTOS_CONFIG_H
+
+#define configTICK_RATE_HZ          ( 1000 )
+#define configSUPPORT_DYNAMIC_ALLOCATION 1
+
+#endif // !FREERTOS_CONFIG_H

examples/include/FreeRTOS-10.0.1/FreeRTOS.h

@@ -0,0 +1,14 @@
+#ifndef FREERTOS_IP_CONFIG_H
+#define FREERTOS_IP_CONFIG_H
+
+#define ipconfigNUM_NETWORK_BUFFER_DESCRIPTORS    10
+#define ipconfigEVENT_QUEUE_LENGTH                ( ipconfigNUM_NETWORK_BUFFER_DESCRIPTORS + 5 )
+#define ipconfigNETWORK_MTU                       1500
+
+#define ipconfigRAND32() 1
+
+#define ipconfigUSE_DNS 0
+#define ipconfigUSE_TCP 0
+#define ipconfigREPLY_TO_INCOMING_PINGS 1
+
+#endif // FREERTOS_IP_CONFIG_H

examples/include/FreeRTOS-10.0.1/FreeRTOSConfig.h

@@ -0,0 +1,12 @@
+#ifndef EVENT_GROUPS_H
+#define EVENT_GROUPS_H
+
+typedef void * EventGroupHandle_t;
+typedef TickType_t EventBits_t;
+
+#define xEventGroupSetBits(g, b) (0)
+#define xEventGroupCreate() (NULL)
+#define xEventGroupWaitBits(g, b, c, a, t) (0)
+#define vEventGroupDelete(g) 
+
+#endif // EVENT_GROUPS_H