Commit 3714ca8a authored Sep 25, 2023 by Flavio Ceolin Committed by Henrik Brix Andersen Nov 07, 2023

ipm: mcux: Fix possible buffer overflow

It is possible to happen a buffer overflow in ipm_send callback
due a wrong comparison between signed/unsigned types.

Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
(cherry picked from commit 6654d185)

parent 84091f5b

drivers/ipm/ipm_mcux.c

+1 −1

Changes for drivers/ipm/ipm_mcux.c: 1 added line, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -92,7 +92,7 @@ static int mcux_mailbox_ipm_send(const struct device *d, int wait,
		return -EINVAL;
		}

		if (size > MCUX_IPM_DATA_REGS * sizeof(uint32_t)) {
		if ((size < 0) \|\| (size > MCUX_IPM_DATA_REGS * sizeof(uint32_t))) {
		return -EMSGSIZE;
		}

Admin message