mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-11-25 03:43:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

smbios: sanitize type from external type before checking have_fields_bitmap

Browse Source 
test_bit uses header->type as an offset; if the file incorrectly specifies a
type greater than 127, smbios_entry_add will read and write garbage.

To fix this, just pass the smbios data through, assuming the user knows what
to do.  Reported by Coverity as CID 1487255.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2022-09-05 12:32:44 +02:00
parent b00e2c68c5
commit 57e3069641
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
hw/smbios/smbios.c
View File

@ -1205,13 +1205,15 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
return;
}
if (test_bit(header->type, have_fields_bitmap)) {
error_setg(errp,
"can't load type %d struct, fields already specified!",
header->type);
return;
if (header->type <= SMBIOS_MAX_TYPE) {
if (test_bit(header->type, have_fields_bitmap)) {
error_setg(errp,
"can't load type %d struct, fields already specified!",
header->type);
return;
}
set_bit(header->type, have_binfile_bitmap);
}
set_bit(header->type, have_binfile_bitmap);
if (header->type == 4) {
smbios_type4_count++;