From 60d682409ed77cadf4ac3942c256c0fad00d2103 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 31 Jul 2024 16:20:37 +0100 Subject: [smbios] Avoid reading beyond end of constructed SMBIOS setting Signed-off-by: Michael Brown --- src/interface/smbios/smbios_settings.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/interface/smbios/smbios_settings.c b/src/interface/smbios/smbios_settings.c index ec31b43f2..ca3f2fe2f 100644 --- a/src/interface/smbios/smbios_settings.c +++ b/src/interface/smbios/smbios_settings.c @@ -130,6 +130,13 @@ static int smbios_fetch ( struct settings *settings __unused, return rc; } + /* Limit length */ + if ( tag_offset > sizeof ( buf ) ) { + tag_len = 0; + } else if ( ( tag_offset + tag_len ) > sizeof ( buf ) ) { + tag_len = ( sizeof ( buf ) - tag_offset ); + } + /* Mangle UUIDs if necessary. iPXE treats UUIDs as * being in network byte order (big-endian). SMBIOS * specification version 2.6 states that UUIDs are -- cgit