mirror of
https://git.yoctoproject.org/poky
synced 2026-02-22 01:19:41 +01:00
3d4850b3ea
The previous CVE-2023-30630_1.patch picked only the patch
"dmidecode: Write the whole dump file at once" d8cfbc808f.
But there was a refactoring which does not allow to cherry-pick it fast
forward. Resolving this conflict was not correctly done. The patch was:
+ u32 len;
+ u8 *table;
...
- if (!(opt.flags & FLAG_QUIET))
- pr_comment("Writing %d bytes to %s.", crafted[0x05],
- opt.dumpfile);
- write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1);
+ dmi_table_dump(crafted, crafted[0x05], table, len);
It looks like the variables len and table have been added without
initialization.
Now this problem is solved by applying the previous refactoring as
well. Patch 1 gets replaced by Patch 1a and Patch 1b. Patch 2..4 are
rebased without changes.
(From OE-Core rev: ea069a94a213cc153528aebfc387f30215566cc7)
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
198 lines
5.0 KiB
Diff
198 lines
5.0 KiB
Diff
From d362549bce92ac22860cda8cad4532c1a3fe6928 Mon Sep 17 00:00:00 2001
|
|
From: Jean Delvare <jdelvare@suse.de>
|
|
Date: Mon, 20 Feb 2023 14:53:25 +0100
|
|
Subject: [PATCH 2/5] dmidecode: Write the whole dump file at once
|
|
|
|
When option --dump-bin is used, write the whole dump file at once,
|
|
instead of opening and closing the file separately for the table
|
|
and then for the entry point.
|
|
|
|
As the file writing function is no longer generic, it gets moved
|
|
from util.c to dmidecode.c.
|
|
|
|
One minor functional change resulting from the new implementation is
|
|
that the entry point is written first now, so the messages printed
|
|
are swapped.
|
|
|
|
Signed-off-by: Jean Delvare <jdelvare@suse.de>
|
|
Reviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com>
|
|
|
|
CVE: CVE-2023-30630
|
|
|
|
Upstream-Status: Backport [https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=d8cfbc808f387e87091c25e7d5b8c2bb348bb206]
|
|
|
|
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
|
|
---
|
|
dmidecode.c | 69 +++++++++++++++++++++++++++++++++++++++--------------
|
|
util.c | 40 -------------------------------
|
|
util.h | 1 -
|
|
3 files changed, 51 insertions(+), 59 deletions(-)
|
|
|
|
diff --git a/dmidecode.c b/dmidecode.c
|
|
index b082c03..a80a140 100644
|
|
--- a/dmidecode.c
|
|
+++ b/dmidecode.c
|
|
@@ -5130,11 +5130,56 @@ static void dmi_table_string(const struct dmi_header *h, const u8 *data, u16 ver
|
|
}
|
|
}
|
|
|
|
-static void dmi_table_dump(const u8 *buf, u32 len)
|
|
+static int dmi_table_dump(const u8 *ep, u32 ep_len, const u8 *table,
|
|
+ u32 table_len)
|
|
{
|
|
+ FILE *f;
|
|
+
|
|
+ f = fopen(opt.dumpfile, "wb");
|
|
+ if (!f)
|
|
+ {
|
|
+ fprintf(stderr, "%s: ", opt.dumpfile);
|
|
+ perror("fopen");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (!(opt.flags & FLAG_QUIET))
|
|
+ pr_comment("Writing %d bytes to %s.", ep_len, opt.dumpfile);
|
|
+ if (fwrite(ep, ep_len, 1, f) != 1)
|
|
+ {
|
|
+ fprintf(stderr, "%s: ", opt.dumpfile);
|
|
+ perror("fwrite");
|
|
+ goto err_close;
|
|
+ }
|
|
+
|
|
+ if (fseek(f, 32, SEEK_SET) != 0)
|
|
+ {
|
|
+ fprintf(stderr, "%s: ", opt.dumpfile);
|
|
+ perror("fseek");
|
|
+ goto err_close;
|
|
+ }
|
|
+
|
|
if (!(opt.flags & FLAG_QUIET))
|
|
- pr_comment("Writing %d bytes to %s.", len, opt.dumpfile);
|
|
- write_dump(32, len, buf, opt.dumpfile, 0);
|
|
+ pr_comment("Writing %d bytes to %s.", table_len, opt.dumpfile);
|
|
+ if (fwrite(table, table_len, 1, f) != 1)
|
|
+ {
|
|
+ fprintf(stderr, "%s: ", opt.dumpfile);
|
|
+ perror("fwrite");
|
|
+ goto err_close;
|
|
+ }
|
|
+
|
|
+ if (fclose(f))
|
|
+ {
|
|
+ fprintf(stderr, "%s: ", opt.dumpfile);
|
|
+ perror("fclose");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+
|
|
+err_close:
|
|
+ fclose(f);
|
|
+ return -1;
|
|
}
|
|
|
|
static void dmi_table_decode(u8 *buf, u32 len, u16 num, u16 ver, u32 flags)
|
|
@@ -5387,11 +5432,7 @@ static int smbios3_decode(u8 *buf, const char *devmem, u32 flags)
|
|
memcpy(crafted, buf, 32);
|
|
overwrite_smbios3_address(crafted);
|
|
|
|
- dmi_table_dump(table, len);
|
|
- if (!(opt.flags & FLAG_QUIET))
|
|
- pr_comment("Writing %d bytes to %s.", crafted[0x06],
|
|
- opt.dumpfile);
|
|
- write_dump(0, crafted[0x06], crafted, opt.dumpfile, 1);
|
|
+ dmi_table_dump(crafted, crafted[0x06], table, len);
|
|
}
|
|
else
|
|
{
|
|
@@ -5463,11 +5504,7 @@ static int smbios_decode(u8 *buf, const char *devmem, u32 flags)
|
|
memcpy(crafted, buf, 32);
|
|
overwrite_dmi_address(crafted + 0x10);
|
|
|
|
- dmi_table_dump(table, len);
|
|
- if (!(opt.flags & FLAG_QUIET))
|
|
- pr_comment("Writing %d bytes to %s.", crafted[0x05],
|
|
- opt.dumpfile);
|
|
- write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1);
|
|
+ dmi_table_dump(crafted, crafted[0x05], table, len);
|
|
}
|
|
else
|
|
{
|
|
@@ -5508,11 +5545,7 @@ static int legacy_decode(u8 *buf, const char *devmem, u32 flags)
|
|
memcpy(crafted, buf, 16);
|
|
overwrite_dmi_address(crafted);
|
|
|
|
- dmi_table_dump(table, len);
|
|
- if (!(opt.flags & FLAG_QUIET))
|
|
- pr_comment("Writing %d bytes to %s.", 0x0F,
|
|
- opt.dumpfile);
|
|
- write_dump(0, 0x0F, crafted, opt.dumpfile, 1);
|
|
+ dmi_table_dump(crafted, 0x0F, table, len);
|
|
}
|
|
else
|
|
{
|
|
diff --git a/util.c b/util.c
|
|
index 04aaadd..1547096 100644
|
|
--- a/util.c
|
|
+++ b/util.c
|
|
@@ -259,46 +259,6 @@ out:
|
|
return p;
|
|
}
|
|
|
|
-int write_dump(size_t base, size_t len, const void *data, const char *dumpfile, int add)
|
|
-{
|
|
- FILE *f;
|
|
-
|
|
- f = fopen(dumpfile, add ? "r+b" : "wb");
|
|
- if (!f)
|
|
- {
|
|
- fprintf(stderr, "%s: ", dumpfile);
|
|
- perror("fopen");
|
|
- return -1;
|
|
- }
|
|
-
|
|
- if (fseek(f, base, SEEK_SET) != 0)
|
|
- {
|
|
- fprintf(stderr, "%s: ", dumpfile);
|
|
- perror("fseek");
|
|
- goto err_close;
|
|
- }
|
|
-
|
|
- if (fwrite(data, len, 1, f) != 1)
|
|
- {
|
|
- fprintf(stderr, "%s: ", dumpfile);
|
|
- perror("fwrite");
|
|
- goto err_close;
|
|
- }
|
|
-
|
|
- if (fclose(f))
|
|
- {
|
|
- fprintf(stderr, "%s: ", dumpfile);
|
|
- perror("fclose");
|
|
- return -1;
|
|
- }
|
|
-
|
|
- return 0;
|
|
-
|
|
-err_close:
|
|
- fclose(f);
|
|
- return -1;
|
|
-}
|
|
-
|
|
/* Returns end - start + 1, assuming start < end */
|
|
u64 u64_range(u64 start, u64 end)
|
|
{
|
|
diff --git a/util.h b/util.h
|
|
index 3094cf8..ef24eb9 100644
|
|
--- a/util.h
|
|
+++ b/util.h
|
|
@@ -27,5 +27,4 @@
|
|
int checksum(const u8 *buf, size_t len);
|
|
void *read_file(off_t base, size_t *len, const char *filename);
|
|
void *mem_chunk(off_t base, size_t len, const char *devmem);
|
|
-int write_dump(size_t base, size_t len, const void *data, const char *dumpfile, int add);
|
|
u64 u64_range(u64 start, u64 end);
|
|
--
|
|
2.41.0
|
|
|