tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging
Pull dmi updates from Jean Delvare.
* 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
firmware: dmi: Fortify entry point length checks
+8
-2
+8
-2
drivers/firmware/dmi_scan.c
+8
-2
drivers/firmware/dmi_scan.c
···
567
567
{
568
568
u32 smbios_ver;
569
569
570
+
/*
571
+
* The size of this structure is 31 bytes, but we also accept value
572
+
* 30 due to a mistake in SMBIOS specification version 2.1.
573
+
*/
570
574
if (memcmp(buf, "_SM_", 4) == 0 &&
571
-
buf[5] < 32 && dmi_checksum(buf, buf[5])) {
575
+
buf[5] >= 30 && buf[5] <= 32 &&
576
+
dmi_checksum(buf, buf[5])) {
572
577
smbios_ver = get_unaligned_be16(buf + 6);
573
578
smbios_entry_point_size = buf[5];
574
579
memcpy(smbios_entry_point, buf, smbios_entry_point_size);
···
634
629
static int __init dmi_smbios3_present(const u8 *buf)
635
630
{
636
631
if (memcmp(buf, "_SM3_", 5) == 0 &&
637
-
buf[6] < 32 && dmi_checksum(buf, buf[6])) {
632
+
buf[6] >= 24 && buf[6] <= 32 &&
633
+
dmi_checksum(buf, buf[6])) {
638
634
dmi_ver = get_unaligned_be24(buf + 7);
639
635
dmi_num = 0; /* No longer specified */
640
636
dmi_len = get_unaligned_le32(buf + 12);