lscpu: fix out-of-bounds read in parse_dmi_table

lscpu: fix out-of-bounds read in parse_dmi_table

parse_dmi_table() walks the SMBIOS structures from the firmware DMI
table. The loop only checks that the 4-byte header fits (data + 4 <=
buf + len) and that h.length >= 4. It then reads the type 0/1/4 fields
at fixed offsets up to data[0x28] and hands the string-number bytes to
dmi_string(), which walks the structure's string set. So a truncated
final structure, where h.length, a field offset or the string set runs
past the end of the table, is read out of bounds; the bytes end up in
the CPU model/vendor strings lscpu prints. The table comes from
/sys/firmware/dmi/tables, or from /dev/mem when probing a hypervisor.

Gate each field read on h.length and stop once a structure (formatted
area plus its string set) no longer fits in the buffer, the way
dmidecode bounds these reads.

Signed-off-by: aizu-m <aizumusheer2@gmail.com>