This is an automated email from the ASF dual-hosted git repository. casaroli pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 9ffd23c08aab6dc03ce180ec7f037bd888eadbce Author: Bowen Wang <[email protected]> AuthorDate: Fri Oct 30 04:11:06 2026 +0800 drivers/rpmsg/rpmsg_port_uart: do not deliver frames that fail validation When a frame fails the length or CRC check at the END delimiter, the rx worker logs it but still adds the buffer to the ready queue, so the corrupted frame is delivered to the endpoint callbacks. Garbage in the payload then makes callbacks follow wild pointers; it shows up as a heap-buffer-overflow under AddressSanitizer in rpmsg_rtc_ept_cb(). Return the buffer to the free queue instead of queueing it. Signed-off-by: Bowen Wang <[email protected]> --- drivers/rpmsg/rpmsg_port_uart.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/rpmsg/rpmsg_port_uart.c b/drivers/rpmsg/rpmsg_port_uart.c index d9557a2af90..766c4a3c1ab 100644 --- a/drivers/rpmsg/rpmsg_port_uart.c +++ b/drivers/rpmsg/rpmsg_port_uart.c @@ -806,9 +806,12 @@ static void rpmsg_port_uart_rx_worker(FAR struct rpmsg_port_uart_s *rpuart, sizeof(rpuart->rx_dbg_buf)); rpmsgerrdump("Recv error:", buf, ret); rpmsgerrdump("Recv hdr:", hdr, hdr->len); + rpmsg_port_queue_return_buffer(rxq, hdr); + } + else + { + rpmsg_port_queue_add_buffer(rxq, hdr); } - - rpmsg_port_queue_add_buffer(rxq, hdr); state = RPMSG_PORT_UART_RX_WAIT_START; hdr = NULL;
