Blame 0009-dmidecode-Check-sysfs-entry-point-length.patch

Anton Arapov 0a7886
From e5c73239404931d4d1b73eb595c3802fbce74c61 Mon Sep 17 00:00:00 2001
Anton Arapov 0a7886
From: Jean Delvare <jdelvare@suse.de>
Anton Arapov 0a7886
Date: Mon, 2 Nov 2015 09:45:36 +0100
Anton Arapov 0a7886
Subject: [PATCH 9/9] dmidecode: Check sysfs entry point length
Anton Arapov 0a7886
Anton Arapov 0a7886
Before passing the sysfs entry point data over for decoding, check
Anton Arapov 0a7886
that its length meets the expectations.
Anton Arapov 0a7886
---
Anton Arapov 0a7886
 CHANGELOG   | 1 +
Anton Arapov 0a7886
 dmidecode.c | 6 +++---
Anton Arapov 0a7886
 2 files changed, 4 insertions(+), 3 deletions(-)
Anton Arapov 0a7886
Anton Arapov 0a7886
diff --git a/CHANGELOG b/CHANGELOG
Anton Arapov 0a7886
index fcfc244..ba61cab 100644
Anton Arapov 0a7886
--- a/CHANGELOG
Anton Arapov 0a7886
+++ b/CHANGELOG
Anton Arapov 0a7886
@@ -5,6 +5,7 @@
Anton Arapov 0a7886
 	* dmidecode.c: Use read_file to read the DMI table from sysfs.
Anton Arapov 0a7886
 	  This fixes Savannah bug #46176:
Anton Arapov 0a7886
 	  https://savannah.nongnu.org/bugs/?46176
Anton Arapov 0a7886
+	* dmidecode.c: Check the sysfs entry point length.
Anton Arapov 0a7886
 
Anton Arapov 0a7886
 2015-10-21  Xie XiuQi  <xiexiuqi@huawei.com>
Anton Arapov 0a7886
 
Anton Arapov 0a7886
diff --git a/dmidecode.c b/dmidecode.c
Anton Arapov 0a7886
index 16d1823..b47c469 100644
Anton Arapov 0a7886
--- a/dmidecode.c
Anton Arapov 0a7886
+++ b/dmidecode.c
Anton Arapov 0a7886
@@ -4840,17 +4840,17 @@ int main(int argc, char * const argv[])
Anton Arapov 0a7886
 	{
Anton Arapov 0a7886
 		if (!(opt.flags & FLAG_QUIET))
Anton Arapov 0a7886
 			printf("Getting SMBIOS data from sysfs.\n");
Anton Arapov 0a7886
-		if (memcmp(buf, "_SM3_", 5) == 0)
Anton Arapov 0a7886
+		if (size >= 24 && memcmp(buf, "_SM3_", 5) == 0)
Anton Arapov 0a7886
 		{
Anton Arapov 0a7886
 			if (smbios3_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET))
Anton Arapov 0a7886
 				found++;
Anton Arapov 0a7886
 		}
Anton Arapov 0a7886
-		else if (memcmp(buf, "_SM_", 4) == 0)
Anton Arapov 0a7886
+		else if (size >= 31 && memcmp(buf, "_SM_", 4) == 0)
Anton Arapov 0a7886
 		{
Anton Arapov 0a7886
 			if (smbios_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET))
Anton Arapov 0a7886
 				found++;
Anton Arapov 0a7886
 		}
Anton Arapov 0a7886
-		else if (memcmp(buf, "_DMI_", 5) == 0)
Anton Arapov 0a7886
+		else if (size >= 15 && memcmp(buf, "_DMI_", 5) == 0)
Anton Arapov 0a7886
 		{
Anton Arapov 0a7886
 			if (legacy_decode(buf, SYS_TABLE_FILE, FLAG_NO_FILE_OFFSET))
Anton Arapov 0a7886
 				found++;
Anton Arapov 0a7886
-- 
Anton Arapov 0a7886
2.5.0
Anton Arapov 0a7886