Open
Description
The following API functions take a buffer address as an input parameter but do not validate that the buffer is valid; rpmsg_hold_rx_buffer, rpmsg_release_rx_buffer, rpmsg_send_offchannel_nocopy.
I suggest adding checks that the buffer plus any data is within the range of valid shared memory within the rpmsg_virtio.c routines.