uefi-ref/edk2
1
0
Fork 0
mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

MdeModulePkg/SmbiosDxe: fix table length check

Browse source 
In case EntryPointStructure does not exist yet use a length of zero instead of
skipping the check altogether.  Fixes a heap overflow in the following code
flow in case the first smbios table installed is larger than
SMBIOS_TABLE_MAX_LENGTH.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Gerd Hoffmann 2026-05-07 08:35:00 +02:00 • committed by mergify[bot]
parent bc71cc972d
commit 3f97b8bc7f
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.c
View file

@ -424,8 +424,8 @@ SmbiosAdd (
// in the Structure Table Length field of the SMBIOS Structure Table Entry Point,
// which is a WORD field limited to 65,535 bytes. So the max size of 32-bit table should not exceed 65,535 bytes.
//
if ((EntryPointStructure != NULL) &&
(EntryPointStructure->TableLength + StructureSize > SMBIOS_TABLE_MAX_LENGTH))
if (((EntryPointStructure != NULL) ? EntryPointStructure->TableLength : 0) +
StructureSize > SMBIOS_TABLE_MAX_LENGTH)
{
DEBUG ((DEBUG_INFO, "SmbiosAdd: Total length exceeds max 32-bit table length with type = %d size = 0x%x\n", Record->Type, StructureSize));
} else {