From d2df50ab05a9d9a85a4b735786fe3f2b6e00186e Mon Sep 17 00:00:00 2001
From: chenluhua1980 <Chenluhua@qq.com>
Date: 星期一, 26 一月 2026 22:19:17 +0800
Subject: [PATCH] 1.已把空指针和防护都补上了：创建消息失败直接返回并删除 action；spooling/发送/序列化都会跳过空消息并记录错误，避免再因 m_pSendMessage 为空导致崩溃或写出坏缓存。
---
SourceCode/Bond/Servo/HsmsPassive.cpp | 83 ++++++++++++++++++++++++++++++++++-------
SourceCode/Bond/Servo/HsmsAction.cpp | 22 ++++++++++-
2 files changed, 89 insertions(+), 16 deletions(-)
diff --git a/SourceCode/Bond/Servo/HsmsAction.cpp b/SourceCode/Bond/Servo/HsmsAction.cpp
index 1c0d71c..1257696 100644
--- a/SourceCode/Bond/Servo/HsmsAction.cpp
+++ b/SourceCode/Bond/Servo/HsmsAction.cpp
@@ -9,6 +9,7 @@
m_nTimeout = 45;
m_nResponseTime = 0;
m_pContext = NULL;
+ m_pSendMessage = NULL;
m_hEvent = ::CreateEvent(NULL, TRUE, FALSE, NULL);
}
@@ -19,6 +20,7 @@
m_nTimeout = nTimeout;
m_nResponseTime = 0;
m_pContext = NULL;
+ m_pSendMessage = NULL;
m_hEvent = ::CreateEvent(NULL, TRUE, FALSE, NULL);
}
@@ -41,6 +43,10 @@
m_bNeedWaitReply = FALSE;
m_nTimeout = 45;
m_nResponseTime = 0;
+ if (m_pSendMessage != NULL) {
+ HSMS_Destroy1Message(m_pSendMessage);
+ m_pSendMessage = NULL;
+ }
::ResetEvent(m_hEvent);
}
@@ -73,6 +79,9 @@
void CHsmsAction::setSendMessage(IMessage* pMessage)
{
+ if (m_pSendMessage != NULL && m_pSendMessage != pMessage) {
+ HSMS_Destroy1Message(m_pSendMessage);
+ }
m_pSendMessage = pMessage;
}
@@ -110,12 +119,15 @@
int CHsmsAction::serialize(char* pszBuffer, int nBufferSize)
{
int index = 0;
+ if (m_pSendMessage == NULL) {
+ return 0;
+ }
if (pszBuffer == nullptr) {
index += sizeof(int);
index += sizeof(m_nTimeout);
index += sizeof(int);
index += sizeof(BOOL);
- index += m_pSendMessage->serialize(pszBuffer, nBufferSize);
+ index += m_pSendMessage->serialize(nullptr, 0);
return index;
}
@@ -157,7 +169,13 @@
memcpy(&m_bNeedWaitReply, &pszBuffer[index], sizeof(BOOL));
index += sizeof(BOOL);
- HSMS_Create1Message(m_pSendMessage, 1, 1 | REPLY, 1, 1);
+ if (m_pSendMessage != NULL) {
+ HSMS_Destroy1Message(m_pSendMessage);
+ m_pSendMessage = NULL;
+ }
+ if (HSMS_Create1Message(m_pSendMessage, 1, 1 | REPLY, 1, 1) != 0 || m_pSendMessage == NULL) {
+ return -1;
+ }
int nRet = m_pSendMessage->unserialize(&pszBuffer[index], nBufferSize - index);
if (nRet < 0) return nRet;
diff --git a/SourceCode/Bond/Servo/HsmsPassive.cpp b/SourceCode/Bond/Servo/HsmsPassive.cpp
index c2359b3..0d0f8a3 100644
--- a/SourceCode/Bond/Servo/HsmsPassive.cpp
+++ b/SourceCode/Bond/Servo/HsmsPassive.cpp
@@ -1909,7 +1909,16 @@
if (pszBuffer == nullptr) {
index += sizeof(int);
for (auto item : m_listActionSpooling) {
- index += item->serialize(pszBuffer, nBufferSize);
+ if (item == nullptr || item->getSendMessage() == nullptr) {
+ LOGE("<HSMS>skip spooling item: null send message");
+ continue;
+ }
+ int nRet = item->serialize(nullptr, 0);
+ if (nRet <= 0) {
+ LOGE("<HSMS>skip spooling item: serialize failed");
+ continue;
+ }
+ index += nRet;
}
index += calcSpoolCfgSize();
@@ -1917,15 +1926,31 @@
return index;
}
else {
- int nTemp, nRet;
+ int nTemp = 0;
+ int nRet = 0;
- nTemp = (int)m_listActionSpooling.size();
+ for (auto item : m_listActionSpooling) {
+ if (item == nullptr || item->getSendMessage() == nullptr) {
+ continue;
+ }
+ if (item->serialize(nullptr, 0) > 0) {
+ ++nTemp;
+ }
+ }
+
memcpy(&pszBuffer[index], &nTemp, sizeof(int));
index += sizeof(int);
for (auto item : m_listActionSpooling) {
+ if (item == nullptr || item->getSendMessage() == nullptr) {
+ LOGE("<HSMS>skip spooling item: null send message");
+ continue;
+ }
nRet = item->serialize(&pszBuffer[index], nBufferSize);
- if (nRet <= 0) break;
+ if (nRet <= 0) {
+ LOGE("<HSMS>skip spooling item: serialize failed");
+ continue;
+ }
index += nRet;
}
@@ -1971,7 +1996,10 @@
for (int i = 0; i < nTemp; i++) {
CHsmsAction* pAction = new CHsmsAction();
nRet = pAction->unserialize(&pszBuffer[index], nBufferSize - index);
- if (nRet <= 0) break;
+ if (nRet <= 0 || pAction->getSendMessage() == nullptr) {
+ delete pAction;
+ break;
+ }
index += nRet;
m_listActionSpooling.push_back(pAction);
}
@@ -2052,6 +2080,11 @@
Unlock();
if (!selected) {
IMessage* pMsg = pAction->getSendMessage();
+ if (pMsg == NULL) {
+ LOGE("<HSMS>spooling drop: null send message");
+ delete pAction;
+ continue;
+ }
uint8_t streamId = 0;
uint8_t functionId = 0;
if (pMsg && pMsg->getHeader()) {
@@ -2073,9 +2106,14 @@
if (pAction->isNeedWaitReply()) {
// 濡傛灉闇�瑕佺瓑寰呭洖澶�
+ IMessage* pMessage = pAction->getSendMessage();
+ if (pMessage == NULL) {
+ LOGE("<HSMS>drop action: null send message");
+ delete pAction;
+ continue;
+ }
Lock();
m_pActiveAction = pAction;
- IMessage* pMessage = pAction->getSendMessage();
Unlock();
ASSERT(pMessage);
@@ -2099,9 +2137,14 @@
Unlock();
}
else {
+ IMessage* pMessage = pAction->getSendMessage();
+ if (pMessage == NULL) {
+ LOGE("<HSMS>drop action: null send message");
+ delete pAction;
+ continue;
+ }
Lock();
m_listActionSent.push_back(pAction);
- IMessage* pMessage = pAction->getSendMessage();
Unlock();
ASSERT(pMessage);
@@ -2144,11 +2187,15 @@
Lock();
CHsmsAction* pAction = new CHsmsAction(ACTION_HELLO, FALSE, m_nActionTimeout);
- m_listAction.push_back(pAction);
IMessage* pMessage = NULL;
- HSMS_Create1Message(pMessage, m_nSessionId, 1 | REPLY, 1, ++m_nSystemByte);
- ASSERT(pMessage);
+ if (HSMS_Create1Message(pMessage, m_nSessionId, 1 | REPLY, 1, ++m_nSystemByte) != 0 || pMessage == NULL) {
+ LOGE("<HSMS>S1F1 create message failed");
+ delete pAction;
+ Unlock();
+ return ER_CREATED_MESSAGE;
+ }
pAction->setSendMessage(pMessage);
+ m_listAction.push_back(pAction);
SetEvent(m_hCimWorkEvent);
Unlock();
@@ -3536,8 +3583,12 @@
CHsmsAction* pAction = new CHsmsAction(ACTION_ALARM_REPORT, TRUE, m_nActionTimeout);
IMessage* pMessage = NULL;
- HSMS_Create1Message(pMessage, m_nSessionId, 5 | REPLY, 1, ++m_nSystemByte);
- ASSERT(pMessage);
+ if (HSMS_Create1Message(pMessage, m_nSessionId, 5 | REPLY, 1, ++m_nSystemByte) != 0 || pMessage == NULL) {
+ LOGE("<HSMS>S5F1 create message failed");
+ delete pAction;
+ Unlock();
+ return ER_CREATED_MESSAGE;
+ }
ISECS2Item* pItem = pMessage->getBody();
pItem->addBinaryItem(szALCD, 1, "ALCD");
pItem->addU4Item(ALID, "ALID");
@@ -3580,8 +3631,12 @@
Lock();
CHsmsAction* pAction = new CHsmsAction(ACTION_EVENT_REPORT, TRUE, m_nActionTimeout);
IMessage* pMessage = NULL;
- HSMS_Create1Message(pMessage, m_nSessionId, 6 | REPLY, 11, ++m_nSystemByte);
- ASSERT(pMessage);
+ if (HSMS_Create1Message(pMessage, m_nSessionId, 6 | REPLY, 11, ++m_nSystemByte) != 0 || pMessage == NULL) {
+ LOGE("<HSMS>S6F11 create message failed");
+ delete pAction;
+ Unlock();
+ return ER_CREATED_MESSAGE;
+ }
ISECS2Item* pItem = pMessage->getBody();
// pItem->addU2Item(++DATAID, "DATAID"); // 鏍规嵁鍒殑鏃ュ織鏄剧ずDATAID鎭掍负0锛屾墍浠ユ垜浠厛鐓т娇鐢�0
pItem->addU2Item(0, "DATAID");
--
Gitblit v1.9.3