Ben Levinsky 49780d11b4 rpmsg: rpc: Validate client reply lengths ...

The RPC client reads the reply ID and status without checking that the
remote message contains the fixed reply header. It also passes the
total message length to callbacks that receive a parameters pointer,
making the reported length include the header bytes.

Reject replies shorter than the fixed header and pass callbacks only
the number of bytes that follow it.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Assisted-by: Codex:GPT-5

2026-09-21 09:54:50 +02:00

..

include

virtqueue: add writable buffer helper

2026-09-21 09:51:59 +02:00

proxy

proxy: Validate retarget write length

2026-09-21 09:54:50 +02:00

remoteproc

remoteproc: avoid wrapping loader offset comparison

2026-09-21 09:50:11 +02:00

rpmsg

rpmsg: virtio: Change release_rx_buffer_nolock() return type to void

2026-09-09 19:09:56 +02:00

service/rpmsg/rpc

rpmsg: rpc: Validate client reply lengths

2026-09-21 09:54:50 +02:00

utils

lib: utils: implement internal safe_strcpy function

2024-10-18 16:13:30 +02:00

virtio

virtqueue: add writable buffer helper

2026-09-21 09:51:59 +02:00

virtio_mmio

virtio_mmio: Statically allocate metal_io_regions

2024-07-05 09:41:06 +02:00

CMakeLists.txt

lib: utils: implement internal safe_strcpy function

2024-10-18 16:13:30 +02:00

version.c

…

version.h.in

…