diff --git a/nav2_ros_common/include/nav2_ros_common/validate_messages.hpp b/nav2_ros_common/include/nav2_ros_common/validate_messages.hpp index 392d3622ed0..2cc012e2606 100644 --- a/nav2_ros_common/include/nav2_ros_common/validate_messages.hpp +++ b/nav2_ros_common/include/nav2_ros_common/validate_messages.hpp @@ -169,6 +169,20 @@ bool validateMsg(const nav_msgs::msg::OccupancyGrid & msg) if (msg.data.size() != msg.info.width * msg.info.height) { return false; // check map-size } + + if (msg.info.width > INT16_MAX || msg.info.height > INT16_MAX) { + // avoid overflow in nav2_amcl::convertMap() + // because map_t size_x and size_y are int + return false; + } + + uint32_t num_cells; + if (__builtin_mul_overflow(msg.info.width, msg.info.height, &num_cells)) { + // avoid overflow msg.info.width * msg.info.height in nav2_amcl::convertMap() + return false; + } + + return true; } diff --git a/nav2_ros_common/test/test_validation_messages.cpp b/nav2_ros_common/test/test_validation_messages.cpp index 1a47ec2142b..26c5c620b94 100644 --- a/nav2_ros_common/test/test_validation_messages.cpp +++ b/nav2_ros_common/test/test_validation_messages.cpp @@ -242,6 +242,30 @@ TEST(ValidateMessagesTest, OccupancyGridCheck) { std::vector invalid_data(100 * 99, 0); // Incorrect data size invalid_occupancy_grid.data = invalid_data; EXPECT_FALSE(nav2::validateMsg(invalid_occupancy_grid)); + + // Test overflow uint32_t OccupancyGrid message + invalid_occupancy_grid.header.frame_id = "map"; + invalid_occupancy_grid.info.resolution = 0.05; + invalid_occupancy_grid.info.width = 65536; + invalid_occupancy_grid.info.height = 65536; + invalid_occupancy_grid.data = data; + EXPECT_FALSE(nav2::validateMsg(invalid_occupancy_grid)); + + // Test overflow INT16_MAX OccupancyGrid message + invalid_occupancy_grid.header.frame_id = "map"; + invalid_occupancy_grid.info.resolution = 0.05; + invalid_occupancy_grid.info.width = INT16_MAX + 1; + invalid_occupancy_grid.info.height = 100; + invalid_occupancy_grid.data = data; + EXPECT_FALSE(nav2::validateMsg(invalid_occupancy_grid)); + + // Test overflow INT16_MAX OccupancyGrid message + invalid_occupancy_grid.header.frame_id = "map"; + invalid_occupancy_grid.info.resolution = 0.05; + invalid_occupancy_grid.info.width = 100; + invalid_occupancy_grid.info.height = INT16_MAX + 1; + invalid_occupancy_grid.data = data; + EXPECT_FALSE(nav2::validateMsg(invalid_occupancy_grid)); } TEST(ValidateMessagesTest, PoseWithCovarianceCheck) {