colin/u-boot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

smbios: buffer overflow when zeroing entry point

Browse Source 
A SMBIOS 3 entry point has a different length than an SMBIOS 2.1 entry
point.

Fixes: 70924294f3 ("smbios: Use SMBIOS 3.0 to support an address above 4GB")
Fixes: 1c5f6fa388 ("smbios: Drop support for SMBIOS2 tables")
Addresses-Coverity-ID: 477212 ("Wrong sizeof argument")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Heinrich Schuchardt
2024-01-11 07:34:08 +01:00
committed by Tom Rini
parent 85946d69d6
commit ccefbf320d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/smbios.c
View File

@@ -591,8 +591,8 @@ ulong write_smbios_table(ulong addr)
table_addr = (ulong)map_sysmem(tables, 0); table_addr = (ulong)map_sysmem(tables, 0);
/* now go back and write the SMBIOS3 header */ /* now go back and write the SMBIOS3 header */
se = map_sysmem(start_addr, sizeof(struct smbios_entry)); se = map_sysmem(start_addr, sizeof(struct smbios3_entry));
memset(se, '\0', sizeof(struct smbios_entry)); memset(se, '\0', sizeof(struct smbios3_entry));
memcpy(se->anchor, "_SM3_", 5); memcpy(se->anchor, "_SM3_", 5);
se->length = sizeof(struct smbios3_entry); se->length = sizeof(struct smbios3_entry);
se->major_ver = SMBIOS_MAJOR_VER; se->major_ver = SMBIOS_MAJOR_VER;