From ee6db10dd70b8fdc7a93cffd7cf5bc7a28f9d3d7 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de>
Date: Mon, 20 Feb 2023 14:53:21 +0100
Subject: [PATCH 1/5] dmidecode: Split table fetching from decoding

Clean up function dmi_table so that it does only one thing:
* dmi_table() is renamed to dmi_table_get(). It now retrieves the
  DMI table, but does not process it any longer.
* Decoding or dumping the table is now done in smbios3_decode(),
  smbios_decode() and legacy_decode().
No functional change.

A side effect of this change is that writing the header and body of
dump files is now done in a single location. This is required to
further consolidate the writing of dump files.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com>

CVE: CVE-2023-30630

Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=39b2dd7b6ab719b920e96ed832cfb4bdd664e808]

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
---
 dmidecode.c | 86 ++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 62 insertions(+), 24 deletions(-)

diff --git a/dmidecode.c b/dmidecode.c
index cd2b5c9..b082c03 100644
--- a/dmidecode.c
+++ b/dmidecode.c
@@ -5247,8 +5247,9 @@ static void dmi_table_decode(u8 *buf, u32 len, u16 num, u16 ver, u32 flags)
 	}
 }
 
-static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem,
-		      u32 flags)
+/* Allocates a buffer for the table, must be freed by the caller */
+static u8 *dmi_table_get(off_t base, u32 *len, u16 num, u32 ver,
+			 const char *devmem, u32 flags)
 {
 	u8 *buf;
 
@@ -5267,7 +5268,7 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem,
 		{
 			if (num)
 				pr_info("%u structures occupying %u bytes.",
-					num, len);
+					num, *len);
 			if (!(opt.flags & FLAG_FROM_DUMP))
 				pr_info("Table at 0x%08llX.",
 					(unsigned long long)base);
@@ -5285,19 +5286,19 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem,
 		 * would be the result of the kernel truncating the table on
 		 * parse error.
 		 */
-		size_t size = len;
+		size_t size = *len;
 		buf = read_file(flags & FLAG_NO_FILE_OFFSET ? 0 : base,
 			&size, devmem);
-		if (!(opt.flags & FLAG_QUIET) && num && size != (size_t)len)
+		if (!(opt.flags & FLAG_QUIET) && num && size != (size_t)*len)
 		{
 			fprintf(stderr, "Wrong DMI structures length: %u bytes "
 				"announced, only %lu bytes available.\n",
-				len, (unsigned long)size);
+				*len, (unsigned long)size);
 		}
-		len = size;
+		*len = size;
 	}
 	else
-		buf = mem_chunk(base, len, devmem);
+		buf = mem_chunk(base, *len, devmem);
 
 	if (buf == NULL)
 	{
@@ -5307,15 +5308,9 @@ static void dmi_table(off_t base, u32 len, u16 num, u32 ver, const char *devmem,
 			fprintf(stderr,
 				"Try compiling dmidecode with -DUSE_MMAP.\n");
 #endif
-		return;
 	}
 
-	if (opt.flags & FLAG_DUMP_BIN)
-		dmi_table_dump(buf, len);
-	else
-		dmi_table_decode(buf, len, num, ver >> 8, flags);
-
-	free(buf);
+	return buf;
 }
 
 
@@ -5350,8 +5345,9 @@ static void overwrite_smbios3_address(u8 *buf)
 
 static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
 {
-	u32 ver;
+	u32 ver, len;
 	u64 offset;
+	u8 *table;
 
 	/* Don't let checksum run beyond the buffer */
 	if (buf[0x06] > 0x20)
@@ -5377,8 +5373,12 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
 		return 0;
 	}
 
-	dmi_table(((off_t)offset.h << 32) | offset.l,
-		  DWORD(buf + 0x0C), 0, ver, devmem, flags | FLAG_STOP_AT_EOT);
+	/* Maximum length, may get trimmed */
+	len = DWORD(buf + 0x0C);
+	table = dmi_table_get(((off_t)offset.h << 32) | offset.l, &len, 0, ver,
+			      devmem, flags | FLAG_STOP_AT_EOT);
+	if (table == NULL)
+		return 1;
 
 	if (opt.flags & FLAG_DUMP_BIN)
 	{
@@ -5387,18 +5387,28 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
 		memcpy(crafted, buf, 32);
 		overwrite_smbios3_address(crafted);
 
+		dmi_table_dump(table, len);
 		if (!(opt.flags & FLAG_QUIET))
 			pr_comment("Writing %d bytes to %s.", crafted[0x06],
 				   opt.dumpfile);
 		write_dump(0, crafted[0x06], crafted, opt.dumpfile, 1);
 	}
+	else
+	{
+		dmi_table_decode(table, len, 0, ver >> 8,
+				 flags | FLAG_STOP_AT_EOT);
+	}
+
+	free(table);
 
 	return 1;
 }
 
 static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
 {
-	u16 ver;
+	u16 ver, num;
+	u32 len;
+	u8 *table;
 
 	/* Don't let checksum run beyond the buffer */
 	if (buf[0x05] > 0x20)
@@ -5438,8 +5448,13 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
 		pr_info("SMBIOS %u.%u present.",
 			ver >> 8, ver & 0xFF);
 
-	dmi_table(DWORD(buf + 0x18), WORD(buf + 0x16), WORD(buf + 0x1C),
-		ver << 8, devmem, flags);
+	/* Maximum length, may get trimmed */
+	len = WORD(buf + 0x16);
+	num = WORD(buf + 0x1C);
+	table = dmi_table_get(DWORD(buf + 0x18), &len, num, ver << 8,
+			      devmem, flags);
+	if (table == NULL)
+		return 1;
 
 	if (opt.flags & FLAG_DUMP_BIN)
 	{
@@ -5448,27 +5463,43 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
 		memcpy(crafted, buf, 32);
 		overwrite_dmi_address(crafted + 0x10);
 
+		dmi_table_dump(table, len);
 		if (!(opt.flags & FLAG_QUIET))
 			pr_comment("Writing %d bytes to %s.", crafted[0x05],
 				   opt.dumpfile);
 		write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1);
 	}
+	else
+	{
+		dmi_table_decode(table, len, num, ver, flags);
+	}
+
+	free(table);
 
 	return 1;
 }
 
 static int legacy_decode(u8 *buf, const char *devmem, u32 flags)
 {
+	u16 ver, num;
+	u32 len;
+	u8 *table;
+
 	if (!checksum(buf, 0x0F))
 		return 0;
 
+	ver = ((buf[0x0E] & 0xF0) << 4) + (buf[0x0E] & 0x0F);
 	if (!(opt.flags & FLAG_QUIET))
 		pr_info("Legacy DMI %u.%u present.",
 			buf[0x0E] >> 4, buf[0x0E] & 0x0F);
 
-	dmi_table(DWORD(buf + 0x08), WORD(buf + 0x06), WORD(buf + 0x0C),
-		((buf[0x0E] & 0xF0) << 12) + ((buf[0x0E] & 0x0F) << 8),
-		devmem, flags);
+	/* Maximum length, may get trimmed */
+	len = WORD(buf + 0x06);
+	num = WORD(buf + 0x0C);
+	table = dmi_table_get(DWORD(buf + 0x08), &len, num, ver << 8,
+			      devmem, flags);
+	if (table == NULL)
+		return 1;
 
 	if (opt.flags & FLAG_DUMP_BIN)
 	{
@@ -5477,11 +5508,18 @@ static int legacy_decode(u8 *buf, const char *devmem, u32 flags)
 		memcpy(crafted, buf, 16);
 		overwrite_dmi_address(crafted);
 
+		dmi_table_dump(table, len);
 		if (!(opt.flags & FLAG_QUIET))
 			pr_comment("Writing %d bytes to %s.", 0x0F,
 				   opt.dumpfile);
 		write_dump(0, 0x0F, crafted, opt.dumpfile, 1);
 	}
+	else
+	{
+		dmi_table_decode(table, len, num, ver, flags);
+	}
+
+	free(table);
 
 	return 1;
 }
-- 
2.41.0

