Snap for 7855943 from 595155cc487accefb00e5ef0d50bb265c161b26d to s-keystone-qcom-release

Change-Id: I4a4496266048c59bbb85054927369b117b847062

1 files changed, 26 insertions, 1 deletions

diff --git a/src/fastrpc_apps_user.c b/src/fastrpc_apps_user.c
index 7d159cf..867702d 100644
--- a/src/fastrpc_apps_user.c
+++ b/src/fastrpc_apps_user.c
@@ -560,11 +560,31 @@ static int fdlist_fd_from_buf(void* buf, int bufLen, int* nova, void** base, int
    return 0;
 }
 
+static inline int is_valid_local_handle(struct handle_info* hinfo) {
+	int domain = 0;
+	QNode* pn = NULL;
+	struct handle_info* hi = NULL;
+
+	for (domain = 0; domain < NUM_DOMAINS_EXTEND; domain++) {
+		pthread_mutex_lock(&hlist[domain].mut);
+		QLIST_FOR_ALL(&hlist[domain].ql, pn) {
+			hi = STD_RECOVER_REC(struct handle_info, qn, pn);
+			if (hi == hinfo) {
+				pthread_mutex_unlock(&hlist[domain].mut);
+				return 1;
+			}
+		}
+		pthread_mutex_unlock(&hlist[domain].mut);
+	}
+	return 0;
+}
+
 static int verify_local_handle(remote_handle64 local) {
 	struct handle_info* hinfo = (struct handle_info*)(uintptr_t)local;
 	int nErr = AEE_SUCCESS;
 
 	VERIFYC(hinfo, AEE_EMEMPTR);
+	VERIFYC(is_valid_local_handle(hinfo), AEE_EBADHANDLE);
 	VERIFYC((hinfo->hlist >= &hlist[0]) && (hinfo->hlist < &hlist[NUM_DOMAINS_EXTEND]), AEE_EMEMPTR);
 	VERIFYC(QNode_IsQueuedZ(&hinfo->qn), AEE_ENOSUCHHANDLE);
 bail:
@@ -1230,7 +1250,12 @@ bail:
 }
 
 int remote_mmap(int fd, uint32_t flags, uint32_t vaddrin, int size, uint32_t* vaddrout) {
-	return remote_mmap64(fd, flags, (uintptr_t)vaddrin, (int64_t)size, (uint64_t*)vaddrout);
+	uint64_t vaddrout_64;
+	int nErr = 0;
+
+	nErr = remote_mmap64(fd, flags, (uintptr_t)vaddrin, (int64_t)size, &vaddrout_64);
+	*vaddrout = (uint32_t)vaddrout_64;
+	return nErr;
 }
 
 int remote_munmap64(uint64_t vaddrout, int64_t size) {