Branch: refs/heads/main Home: https://github.com/OpenAMP/open-amp Commit: 372048d49dc46a58586af3b62e94d4952bf92d59 https://github.com/OpenAMP/open-amp/commit/372048d49dc46a58586af3b62e94d4952... Author: Ben Levinsky ben.levinsky@amd.com Date: 2026-09-21 (Mon, 21 Sep 2026)

Changed paths: M lib/service/rpmsg/rpc/rpmsg_rpc_server.c

Log Message: ----------- rpmsg: rpc: Validate and initialize server requests

The RPC callback does not receive the request length, so it may inspect bytes beyond a short message. Those bytes currently come from an uninitialized stack buffer. A message shorter than the function ID can also make the dispatch path read uninitialized data.

Reject messages that do not contain a complete function ID and zero-initialize the request buffer so callbacks never consume stale stack contents from bytes omitted by the remote peer.

Signed-off-by: Ben Levinsky ben.levinsky@amd.com Assisted-by: Codex:GPT-5

Commit: 2b7013e7335aa62de8e62f2084e668fa6c6995c2 https://github.com/OpenAMP/open-amp/commit/2b7013e7335aa62de8e62f2084e668fa6... Author: Ben Levinsky ben.levinsky@amd.com Date: 2026-09-21 (Mon, 21 Sep 2026)

Changed paths: M lib/proxy/rpmsg_retarget.c

Log Message: ----------- proxy: Validate retarget write length

_write() copies a caller-controlled length into a fixed-size stack buffer without checking that the RPC header and payload fit. Negative lengths also become large unsigned memcpy() sizes, and the stdout NUL terminator is written one byte beyond its intended position.

Reject invalid lengths before constructing the request. Include the optional terminator in the capacity check and place the terminator immediately after the copied payload.

Signed-off-by: Ben Levinsky ben.levinsky@amd.com Assisted-by: Codex:GPT-5

Commit: 49780d11b49f3e2bea558d9ccd22e61487ed9e85 https://github.com/OpenAMP/open-amp/commit/49780d11b49f3e2bea558d9ccd22e6148... Author: Ben Levinsky ben.levinsky@amd.com Date: 2026-09-21 (Mon, 21 Sep 2026)

Changed paths: M lib/service/rpmsg/rpc/rpmsg_rpc_client.c

Log Message: ----------- rpmsg: rpc: Validate client reply lengths

The RPC client reads the reply ID and status without checking that the remote message contains the fixed reply header. It also passes the total message length to callbacks that receive a parameters pointer, making the reported length include the header bytes.

Reject replies shorter than the fixed header and pass callbacks only the number of bytes that follow it.

Signed-off-by: Ben Levinsky ben.levinsky@amd.com Assisted-by: Codex:GPT-5

Commit: f7c918bf07e3ad884247d06aad84b892c958e065 https://github.com/OpenAMP/open-amp/commit/f7c918bf07e3ad884247d06aad84b892c... Author: Ben Levinsky ben.levinsky@amd.com Date: 2026-09-21 (Mon, 21 Sep 2026)

Changed paths: M lib/include/openamp/rpmsg_rpc_client_server.h M lib/service/rpmsg/rpc/rpmsg_rpc_client.c

Log Message: ----------- rpmsg: rpc: Validate client request lengths

The RPC client copies caller-provided parameters into a fixed-size stack buffer without checking whether the complete request fits. Oversized requests can therefore overwrite the caller's stack frame.

Reject requests that exceed the remaining parameter capacity before copying them, validate nonempty parameter pointers, and document the public API limit.

Signed-off-by: Ben Levinsky ben.levinsky@amd.com Assisted-by: Codex:GPT-5

Commit: d0e5e0d376a320026211312df890fedf46ec4bc4 https://github.com/OpenAMP/open-amp/commit/d0e5e0d376a320026211312df890fedf4... Author: Ben Levinsky ben.levinsky@amd.com Date: 2026-09-21 (Mon, 21 Sep 2026)

Changed paths: M lib/proxy/rpmsg_retarget.c

Log Message: ----------- proxy: Validate retarget read response length

_read() converts the peer-provided unsigned data length to a signed integer and bounds it only against the caller's buffer size. Large values can bypass that comparison or make memcpy() read beyond the fixed response buffer.

Reject nonpositive destination sizes, retain the peer length as an unsigned value, and clamp it to both the response payload capacity and the caller's buffer before copying.

Signed-off-by: Ben Levinsky ben.levinsky@amd.com Assisted-by: Codex:GPT-5

Compare: https://github.com/OpenAMP/open-amp/compare/80284e3ac0e9...d0e5e0d376a3

To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/open-amp/settings/notifications