Description
rosbag2_transport::type_description_hash_for_topic() does not perform a defensive check for the case where topic_type is a null pointer when handling TopicEndpointInfo. When a type hash conflict is detected and a warning log is printed, info.topic_type() is called unconditionally, which results in constructing std::string(nullptr) when the underlying topic_type == nullptr, thereby throwing an exception and causing the function to crash.
Expected Behavior
The program is running normally
Actual Behavior
Program exception
To Reproduce
Test Case
#include <gmock/gmock.h>
#include <string>
#include "rosbag2_transport/recorder.hpp"
using namespace ::testing; // NOLINT
rosidl_type_hash_t all_zeros()
{
rosidl_type_hash_t type_hash;
type_hash.version = 0;
for (int i = 0; i < ROSIDL_TYPE_HASH_SIZE; ++i) {
type_hash.value[i] = 0;
}
return type_hash;
}
rosidl_type_hash_t valid_v1_type_hash()
{
rosidl_type_hash_t type_hash;
type_hash.version = 1;
for (int i = 0; i < ROSIDL_TYPE_HASH_SIZE; ++i) {
type_hash.value[i] = i;
}
return type_hash;
}
TEST(TestTopicTypeHash, test) {
rcl_topic_endpoint_info_t info;
info.topic_type_hash = valid_v1_type_hash();
info.topic_type = nullptr;
info.node_name = "node_name";
info.node_namespace = "node_namespace";
info.endpoint_type = RMW_ENDPOINT_INVALID;
info.qos_profile = rmw_qos_profile_default;
std::vector<rclcpp::TopicEndpointInfo> endpoints {
rclcpp::TopicEndpointInfo(info)
};
std::string result = rosbag2_transport::type_description_hash_for_topic(endpoints);
EXPECT_EQ("", result);
}
Output
[ RUN ] TestTopicTypeHash.test
unknown file: Failure
C++ exception with description "basic_string: construction from null is not valid" thrown in the test body.
[ FAILED ] TestTopicTypeHash.test (0 ms)
[----------] 1 test from TestTopicTypeHash (0 ms total)
[----------] Global test environment tear-down
[==========] 1 test from 1 test suite ran. (0 ms total)
[ PASSED ] 0 tests.
[ FAILED ] 1 test, listed below:
[ FAILED ] TestTopicTypeHash.test
1 FAILED TEST
System (please complete the following information)
OS: ubuntu 24.04
ROS 2 Distro: ros 2 jazzy
Install Method: source
Version: ros 2 jazzy
Description
rosbag2_transport::type_description_hash_for_topic() does not perform a defensive check for the case where topic_type is a null pointer when handling TopicEndpointInfo. When a type hash conflict is detected and a warning log is printed, info.topic_type() is called unconditionally, which results in constructing std::string(nullptr) when the underlying topic_type == nullptr, thereby throwing an exception and causing the function to crash.
Expected Behavior
The program is running normally
Actual Behavior
Program exception
To Reproduce
Test Case
Output
System (please complete the following information)
OS: ubuntu 24.04
ROS 2 Distro: ros 2 jazzy
Install Method: source
Version: ros 2 jazzy