Commit eeea26d2 authored Sep 26, 2023 by Flavio Ceolin Committed by Maureen Helm Sep 27, 2023

ipm: cavs: Fix possible buffer overflow

A buffer overflow happens in send() when size is negative because
it is promoted to signed when used in memcpy.

Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>

parent 98857c26

drivers/ipm/ipm_cavs_host.c

+1 −1

Changes for drivers/ipm/ipm_cavs_host.c: 1 added line, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -56,7 +56,7 @@ static int send(const struct device *dev, int wait, uint32_t id,
		return -EBUSY;
		}

		if (size > MAX_MSG) {
		if ((size < 0) \|\| (size > MAX_MSG)) {
		return -EMSGSIZE;
		}

Admin message