From c76ddda0ba0aa99a55945e3290095c2ec493c892 Mon Sep 17 00:00:00 2001 From: Jean Delvare Date: Tue, 27 Jun 2023 10:25:50 +0000 Subject: [PATCH] Consistently use read_file() when reading from a dump file Use read_file() instead of mem_chunk() to read the entry point from a dump file. This is faster, and consistent with how we then read the actual DMI table from that dump file. This made no functional difference so far, which is why it went unnoticed for years. But now that a file type check was added to the mem_chunk() function, we must stop using it to read from regular files. This will again allow root to use the --from-dump option. Signed-off-by: Jean Delvare Tested-by: Jerry Hoemann CVE: CVE-2023-30630 Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=c76ddda0ba0aa99a55945e3290095c2ec493c892] Signed-off-by: Yogita Urade --- dmidecode.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/dmidecode.c b/dmidecode.c index 98f9692..b4dbc9d 100644 --- a/dmidecode.c +++ b/dmidecode.c @@ -5997,17 +5997,25 @@ int main(int argc, char * const argv[]) pr_comment("dmidecode %s", VERSION); /* Read from dump if so instructed */ + size = 0x20; if (opt.flags & FLAG_FROM_DUMP) { if (!(opt.flags & FLAG_QUIET)) pr_info("Reading SMBIOS/DMI data from file %s.", opt.dumpfile); - if ((buf = mem_chunk(0, 0x20, opt.dumpfile)) == NULL) + if ((buf = read_file(0, &size, opt.dumpfile)) == NULL) { ret = 1; goto exit_free; } + /* Truncated entry point can't be processed */ + if (size < 0x20) + { + ret = 1; + goto done; + } + if (memcmp(buf, "_SM3_", 5) == 0) { if (smbios3_decode(buf, opt.dumpfile, 0)) @@ -6031,7 +6039,6 @@ int main(int argc, char * const argv[]) * contain one of several types of entry points, so read enough for * the largest one, then determine what type it contains. */ - size = 0x20; if (!(opt.flags & FLAG_NO_SYSFS) && (buf = read_file(0, &size, SYS_ENTRY_FILE)) != NULL) { -- 2.40.0