Describe the bug
xTaskCreate() accepts a task stack depth in words. On 32-bit Cortex-M ports, the default configSTACK_DEPTH_TYPE and size_t are both 32-bit, but the kernel allocates the stack using unchecked uxStackDepth * sizeof(StackType_t). An oversized depth wraps to a small allocation; initialization then retains the original depth and performs stack pointer arithmetic using that value.
Target
FreeRTOS revision 592732b4d
FreeRTOS/Source/tasks.c, prvCreateTask() and prvInitialiseNewTask()
Cortex-M7 default port: FreeRTOS/Source/portable/GCC/ARM_CM7/r0p1/portmacro.h
Host
To Reproduce
On a 32-bit size_t / 32-bit StackType_t target, pass a depth greater than UINT32_MAX / 4; for example 0x40000020 words. The allocation expression wraps to 128 bytes, while prvInitialiseNewTask() computes a top-of-stack using pxStack[uxStackDepth - 1] and initializes the task from that original depth.
Expected behavior
The allocation-size multiplication is not checked before pvPortMallocStack(). The later initialization path assumes the requested word count was allocated.
Additional context
Before allocating, reject uxStackDepth > SIZE_MAX / sizeof(StackType_t) and return task-creation failure. Apply the same check to all dynamic stack allocation paths. A product should additionally impose a realistic maximum task-stack size at its API boundary.
Describe the bug
xTaskCreate() accepts a task stack depth in words. On 32-bit Cortex-M ports, the default configSTACK_DEPTH_TYPE and size_t are both 32-bit, but the kernel allocates the stack using unchecked uxStackDepth * sizeof(StackType_t). An oversized depth wraps to a small allocation; initialization then retains the original depth and performs stack pointer arithmetic using that value.
Target
FreeRTOS revision 592732b4d
FreeRTOS/Source/tasks.c, prvCreateTask() and prvInitialiseNewTask()
Cortex-M7 default port: FreeRTOS/Source/portable/GCC/ARM_CM7/r0p1/portmacro.h
Host
To Reproduce
On a 32-bit size_t / 32-bit StackType_t target, pass a depth greater than UINT32_MAX / 4; for example 0x40000020 words. The allocation expression wraps to 128 bytes, while prvInitialiseNewTask() computes a top-of-stack using pxStack[uxStackDepth - 1] and initializes the task from that original depth.
Expected behavior
The allocation-size multiplication is not checked before pvPortMallocStack(). The later initialization path assumes the requested word count was allocated.
Additional context
Before allocating, reject uxStackDepth > SIZE_MAX / sizeof(StackType_t) and return task-creation failure. Apply the same check to all dynamic stack allocation paths. A product should additionally impose a realistic maximum task-stack size at its API boundary.