diff options
| author | Vamsi Krishna Gattupalli <vgattupa@codeaurora.org> | 2021-09-07 18:01:24 +0530 |
|---|---|---|
| committer | Vamsi Krishna Gattupalli <vgattupa@codeaurora.org> | 2021-09-07 18:03:57 +0530 |
| commit | 5441a5be1ae11a0a34a0f77f59e97e249b2b5872 (patch) | |
| tree | 993049af26d69d6fc6bd54cf9d7ed540e77e63d0 | |
| parent | e1d47a2f17656e1088b53633092ee849d55d2dd2 (diff) | |
ADSPRPC: Pass 64 bit va buffer to remote_mmap64 from remote_mmap
API remote_mmap is a wrapper that calls remote_mmap64 with
32 bit VA buffer. API remote_mmap64 will write 64 bit to VA
buffer, which will result in buffer overflow.
Adding intermediate 64 bit buffer in between call to remote_mmap64
and then safely copying from 64 bit buffer to 32 bit buffer.
CRs-Fixed: 2960630
Change-Id: I1a1671e0150bbd6305fea4d2805bc62807b89b3b
| -rw-r--r-- | src/fastrpc_apps_user.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/fastrpc_apps_user.c b/src/fastrpc_apps_user.c index 7d159cf..b3f12d0 100644 --- a/src/fastrpc_apps_user.c +++ b/src/fastrpc_apps_user.c @@ -1230,7 +1230,12 @@ bail: } int remote_mmap(int fd, uint32_t flags, uint32_t vaddrin, int size, uint32_t* vaddrout) { - return remote_mmap64(fd, flags, (uintptr_t)vaddrin, (int64_t)size, (uint64_t*)vaddrout); + uint64_t vaddrout_64; + int nErr = 0; + + nErr = remote_mmap64(fd, flags, (uintptr_t)vaddrin, (int64_t)size, &vaddrout_64); + *vaddrout = (uint32_t)vaddrout_64; + return nErr; } int remote_munmap64(uint64_t vaddrout, int64_t size) { |