UCI Ranging heap memory corruption

as I’ve posted, I’m adding a new transport to the UCI firmware in SDK 1.1.1,
on my previous troubles, the controller ranging NTFs did not come thru, due to a heap memory allocation failure..

now that this problem was resolved, I’m experiencing some qmsg_queue get/put hard fault failures, referencing low memory (0)..

tracing this we’ve discovered that the UCI/Fira runtime allocates a buffer 25000 bytes during ranging startup, BUT writes 25004 bytes, maybe a memset, 4 bytes off the end of the buffer… which JUST so happens to contain the control blocks for the queue objects.. which causes a hardfault crash on qmsg get or put later

we’ve worked around this by hacking the pvPortMalloc call in the freertos lib in the Nordic SDK,
called by the qosal qmalloc lib

./SDK_BSP/Nordic/SDK_17_1_0/external/freertos/source/portable/MemMang/heap_4.c
and adding an 8 byte increase in the requested memory size to provide a overrun buffer..

the fira source is closed to me, so I cannot get any closer to identifying the actual failure

1 Like