lib: rpmsg: Fix safe_strcpy call

Fix the size of the source string passed in argument of safe_strcpy(). In rpmsg_create_ept we can not trust the size of the name string provided, so we limit the max size to RPMSG_NAME_SIZE. Update the rpmsg_create_ept documentation to clarify the limit Signed-off-by: Arnaud Pouliquen <[email protected]>
OpenAMP · Oct 25, 2024 · 845a17b · 845a17b
1 parent 2a93d20
commit 845a17b
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/lib/include/openamp/rpmsg.h b/lib/include/openamp/rpmsg.h
@@ -564,7 +564,7 @@ static inline int rpmsg_send_nocopy(struct rpmsg_endpoint *ept,
  *
  * @param ept		Pointer to rpmsg endpoint
  * @param rdev		RPMsg device associated with the endpoint
- * @param name		Service name associated to the endpoint
+ * @param name		Service name associated to the endpoint (maximum size \ref RPMSG_NAME_SIZE)
  * @param src		Local address of the endpoint
  * @param dest		Target address of the endpoint
  * @param cb		Endpoint callback

diff --git a/lib/rpmsg/rpmsg.c b/lib/rpmsg/rpmsg.c
@@ -142,7 +142,7 @@ int rpmsg_send_ns_message(struct rpmsg_endpoint *ept, unsigned long flags)
 
 	ns_msg.flags = flags;
 	ns_msg.addr = ept->addr;
-	(void)safe_strcpy(ns_msg.name, sizeof(ns_msg.name), ept->name, strlen(ept->name));
+	(void)safe_strcpy(ns_msg.name, sizeof(ns_msg.name), ept->name, sizeof(ept->name));
 	ret = rpmsg_send_offchannel_raw(ept, ept->addr,
 					RPMSG_NS_EPT_ADDR,
 					&ns_msg, sizeof(ns_msg), true);
@@ -307,7 +307,7 @@ void rpmsg_register_endpoint(struct rpmsg_device *rdev,
 			     rpmsg_ns_unbind_cb ns_unbind_cb, void *priv)
 {
 	if (name)
-		(void)safe_strcpy(ept->name, sizeof(ept->name), name, sizeof(name));
+		(void)safe_strcpy(ept->name, sizeof(ept->name), name, RPMSG_NAME_SIZE);
 	else
 		ept->name[0] = 0;