)]}'
{
  "commit": "c6bcc8ca191e82a004d30371c943b020ae90a788",
  "tree": "74b2063aaff345124ae977acf6dc3f654fe4df96",
  "parents": [
    "75ed40954228af38b6d98433c0f0d42f003501b8"
  ],
  "author": {
    "name": "Hugo Lefeuvre",
    "email": "hugo.lefeuvre@scisemi.com",
    "time": "Mon May 13 10:06:14 2024 +0200"
  },
  "committer": {
    "name": "David Chisnall",
    "email": "davidchisnall@users.noreply.github.com",
    "time": "Mon May 13 11:33:20 2024 +0100"
  },
  "message": "Fix buffer overflow in the FreeRTOS compat queue.\n\nOur allocation size only covers the first field of `QueueHandle_t`\n(`struct QueueHandle`), and the `void * freePointer` is out of bounds.\nThis may be due to unfortunate naming of the two data types - I would\ntypically expect `QueueHandle_t` to be an alias for `struct QueueHandle`\nbut that is not the case here.\n\nUnfortunately this has not been detected earlier because the Arty board\n(unlike the Ibex simulator) does not seem to trigger a tag violation.\nThis will be investigated separately.\n\nFor now, add a test that highlights the bug in the Ibex simulator, and\nfix the bug. The test is intentionally left very simple, we can extend\nlater on if needed.\n\nSigned-off-by: Hugo Lefeuvre \u003chugo.lefeuvre@scisemi.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "25c9e2598ab3d8aafd0bf25d0eafe47707df1863",
      "old_mode": 33188,
      "old_path": "sdk/include/FreeRTOS-Compat/queue.h",
      "new_id": "088d58801472e41bfba477dec85d9722b1e98289",
      "new_mode": 33188,
      "new_path": "sdk/include/FreeRTOS-Compat/queue.h"
    },
    {
      "type": "modify",
      "old_id": "6d49f2897e1a43f0eacf2b46ed2f7fdeb0ea0868",
      "old_mode": 33188,
      "old_path": "tests/queue-test.cc",
      "new_id": "3b1fd052124d1962fb6a7966ef2260b8ebcc675f",
      "new_mode": 33188,
      "new_path": "tests/queue-test.cc"
    }
  ]
}