From: Michael Brown <mcb30@ipxe.org>
Date: Wed, 31 Jul 2024 15:20:37 +0000 (+0100)
Subject: [smbios] Avoid reading beyond end of constructed SMBIOS setting
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=60d682409ed77cadf4ac3942c256c0fad00d2103;p=thirdparty%2Fipxe.git

[smbios] Avoid reading beyond end of constructed SMBIOS setting

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/interface/smbios/smbios_settings.c b/src/interface/smbios/smbios_settings.c
index ec31b43f2..ca3f2fe2f 100644
--- a/src/interface/smbios/smbios_settings.c
+++ b/src/interface/smbios/smbios_settings.c
@@ -130,6 +130,13 @@ static int smbios_fetch ( struct settings *settings __unused,
 			return rc;
 		}
 
+		/* Limit length */
+		if ( tag_offset > sizeof ( buf ) ) {
+			tag_len = 0;
+		} else if ( ( tag_offset + tag_len ) > sizeof ( buf ) ) {
+			tag_len = ( sizeof ( buf ) - tag_offset );
+		}
+
 		/* Mangle UUIDs if necessary.  iPXE treats UUIDs as
 		 * being in network byte order (big-endian).  SMBIOS
 		 * specification version 2.6 states that UUIDs are