From 5441a5be1ae11a0a34a0f77f59e97e249b2b5872 Mon Sep 17 00:00:00 2001 From: Vamsi Krishna Gattupalli Date: Tue, 7 Sep 2021 18:01:24 +0530 Subject: ADSPRPC: Pass 64 bit va buffer to remote_mmap64 from remote_mmap API remote_mmap is a wrapper that calls remote_mmap64 with 32 bit VA buffer. API remote_mmap64 will write 64 bit to VA buffer, which will result in buffer overflow. Adding intermediate 64 bit buffer in between call to remote_mmap64 and then safely copying from 64 bit buffer to 32 bit buffer. CRs-Fixed: 2960630 Change-Id: I1a1671e0150bbd6305fea4d2805bc62807b89b3b --- src/fastrpc_apps_user.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/fastrpc_apps_user.c b/src/fastrpc_apps_user.c index 7d159cf..b3f12d0 100644 --- a/src/fastrpc_apps_user.c +++ b/src/fastrpc_apps_user.c @@ -1230,7 +1230,12 @@ bail: } int remote_mmap(int fd, uint32_t flags, uint32_t vaddrin, int size, uint32_t* vaddrout) { - return remote_mmap64(fd, flags, (uintptr_t)vaddrin, (int64_t)size, (uint64_t*)vaddrout); + uint64_t vaddrout_64; + int nErr = 0; + + nErr = remote_mmap64(fd, flags, (uintptr_t)vaddrin, (int64_t)size, &vaddrout_64); + *vaddrout = (uint32_t)vaddrout_64; + return nErr; } int remote_munmap64(uint64_t vaddrout, int64_t size) { -- cgit v1.2.3