rpmsg_virtio_get_tx_payload_buffer assumes a full header will be present

[tammyleino]

rpmsg_virtio_get_tx_payload_buffer assumes the payload will contain a full header and does not check whether the returned buffer size from rpmsg_virtio_get_tx_buffer is at least size of "rpmsg_hdr" structure before buffer size is decremented. Is it impossible for a bad packet to be received at this layer?

[arnopo]

At least for the host (master) a check should be added in rpmsg_init_vdev_with_config to ensure that the buffers size is valid.
Then an assert could be added for device (slave) to protect from or invalid initialization or memory corruption.

[tammyleino]

Is it necessary to use rpmsg_init_vdev_with_config though? Isn't it optional to use rpmsg_init_vdev instead?

[arnopo]

you can use rpmsg_init_vdev which internally calls rpmsg_init_vdev_with_config with the RPMSG_VIRTIO_DEFAULT_CONFIG config

[github-actions]

This issue has been marked as a stale issue because it has been open (more than) 45 days with no activity.