Skip to content

Commit

Permalink
lib: rpmsg: Fix safe_strcpy call
Browse files Browse the repository at this point in the history
Fix the size of the source string passed in argument of safe_strcpy().
In rpmsg_register_endpoint we can not trust the size of the name
string provided, so we limit the max size to RPMSG_NAME_SIZE.

Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
  • Loading branch information
arnopo committed Oct 21, 2024
1 parent bb4459f commit d337fed
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions lib/rpmsg/rpmsg.c
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ int rpmsg_send_ns_message(struct rpmsg_endpoint *ept, unsigned long flags)

ns_msg.flags = flags;
ns_msg.addr = ept->addr;
(void)safe_strcpy(ns_msg.name, sizeof(ns_msg.name), ept->name, strlen(ept->name));
(void)safe_strcpy(ns_msg.name, sizeof(ns_msg.name), ept->name, sizeof(ept->name));
ret = rpmsg_send_offchannel_raw(ept, ept->addr,
RPMSG_NS_EPT_ADDR,
&ns_msg, sizeof(ns_msg), true);
Expand Down Expand Up @@ -307,7 +307,8 @@ void rpmsg_register_endpoint(struct rpmsg_device *rdev,
rpmsg_ns_unbind_cb ns_unbind_cb, void *priv)
{
if (name)
(void)safe_strcpy(ept->name, sizeof(ept->name), name, sizeof(name));
(void)safe_strcpy(ept->name, sizeof(ept->name), name,
strnlen(name, RPMSG_NAME_SIZE));
else
ept->name[0] = 0;

Expand Down

0 comments on commit d337fed

Please sign in to comment.