diff options
| author | Michal Simek <michal.simek@xilinx.com> | 2020-11-06 13:55:45 +0100 |
|---|---|---|
| committer | Michal Simek <michal.simek@xilinx.com> | 2020-11-20 10:42:54 +0100 |
| commit | b8771d0b1d660dfe34d55ddf320495325315d1d9 (patch) | |
| tree | 1320ec1287fab68b6842673496d749643d61872a | |
| parent | 5fb093f471d2ded8f8ad58a85f247b84631ca8dc (diff) | |
| download | u-boot-b8771d0b1d660dfe34d55ddf320495325315d1d9.zip u-boot-b8771d0b1d660dfe34d55ddf320495325315d1d9.tar.gz u-boot-b8771d0b1d660dfe34d55ddf320495325315d1d9.tar.bz2 | |
fru: ops: Do not let parser to write data to not allocated space
If customs fields in board area are used it will likely go over allocated
space in struct fru_board_data. That's why calculate limit of this
structure to make sure that different data is not rewritten by accident.
When limit is reached stop to record fields.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
| -rw-r--r-- | board/xilinx/common/fru_ops.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/board/xilinx/common/fru_ops.c b/board/xilinx/common/fru_ops.c index affcb12..b4cd3d4 100644 --- a/board/xilinx/common/fru_ops.c +++ b/board/xilinx/common/fru_ops.c @@ -163,12 +163,15 @@ static int fru_parse_board(unsigned long addr) { u8 i, type; int len; - u8 *data, *term; + u8 *data, *term, *limit; memcpy(&fru_data.brd.ver, (void *)addr, 6); addr += 6; data = (u8 *)&fru_data.brd.manufacturer_type_len; + /* Record max structure limit not to write data over allocated space */ + limit = data + sizeof(struct fru_board_data); + for (i = 0; ; i++, data += FRU_BOARD_MAX_LEN) { len = fru_check_type_len(*(u8 *)addr, fru_data.brd.lang_code, &type); @@ -178,6 +181,9 @@ static int fru_parse_board(unsigned long addr) if (len == -EINVAL) break; + /* Stop when amount of chars is more then fields to record */ + if (data + len > limit) + break; /* This record type/len field */ *data++ = *(u8 *)addr; |