hw/smbios: verify header type for file before using it

[PATCH v1] hw/smbios: verify header type for file before using it

Daniil Tatianin posted 1 patch 2 years, 5 months ago

Download mbox

Test checkpatch passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20211129135211.1114466-1-d-tatianin@yandex-team.ru

Maintainers: Igor Mammedov <imammedo@redhat.com>, Ani Sinha <ani@anisinha.ca>, "Michael S. Tsirkin" <mst@redhat.com>

hw/smbios/smbios.c | 6 ++++++
1 file changed, 6 insertions(+)

Expand all Fold all

[PATCH v1] hw/smbios: verify header type for file before using it

Posted by Daniil Tatianin 2 years, 5 months ago

Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
---
 hw/smbios/smbios.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
index 7397e56737..c55f77368a 100644
--- a/hw/smbios/smbios.c
+++ b/hw/smbios/smbios.c
@@ -1163,6 +1163,12 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
             return;
         }
 
+        if (header->type > SMBIOS_MAX_TYPE) {
+            error_setg(errp,
+                       "invalid header type %d!", header->type);
+            return;
+        }
+
         if (test_bit(header->type, have_fields_bitmap)) {
             error_setg(errp,
                        "can't load type %d struct, fields already specified!",
-- 
2.25.1

Re: [PATCH v1] hw/smbios: verify header type for file before using it

Posted by Igor Mammedov 2 years, 3 months ago

On Mon, 29 Nov 2021 16:52:11 +0300
Daniil Tatianin <d-tatianin@yandex-team.ru> wrote:

here should be more verbose description of the issue
preferably with a way to reproduce it.
and what/why patch does what it does.

> Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
> ---
>  hw/smbios/smbios.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
> index 7397e56737..c55f77368a 100644
> --- a/hw/smbios/smbios.c
> +++ b/hw/smbios/smbios.c
> @@ -1163,6 +1163,12 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
>              return;
>          }
>  
> +        if (header->type > SMBIOS_MAX_TYPE) {
> +            error_setg(errp,
> +                       "invalid header type %d!", header->type);

3.0 spec says that types over 127 are valid and for use by OEM/etc,
but QEMU doesn't support anything over 127 due to limited size of
have_fields_bitmap.
So I'd rephrase it as "unsupported header type"

> +            return;
> +        }
> +
>          if (test_bit(header->type, have_fields_bitmap)) {
>              error_setg(errp,
>                         "can't load type %d struct, fields already specified!",