In fru_parse_multirec() the OEM MAC memcpy uses the EEPROM record
length minus the IANA/version prefix with no check against the
destination. A short record makes that length negative and it is
converted to a large unsigned size by memcpy(), while an oversized
record writes past the stored MAC array.
Validate the OEM MAC record length before calculating the copy size.
Return -EINVAL when the MAC payload is not a whole number of MAC
addresses or exceeds the destination buffer.
Fixes: 7a036b674fc8 ("fru: ops: Add support to read mac addresses from
multirecord")
Signed-off-by: Pranav Tilak <[email protected]>
---
board/xilinx/common/fru_ops.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/board/xilinx/common/fru_ops.c b/board/xilinx/common/fru_ops.c
index 610293bccf7..24b135f7666 100644
--- a/board/xilinx/common/fru_ops.c
+++ b/board/xilinx/common/fru_ops.c
@@ -260,8 +260,13 @@ static int fru_parse_multirec(unsigned long addr)
if (CONFIG_IS_ENABLED(FRU_SC))
type = FRU_SC_MACID;
- if (mac->ver == type) {
+ if (mrc.len >= FRU_MULTIREC_MAC_OFFSET &&
+ mac->ver == type) {
mac_len = mrc.len - FRU_MULTIREC_MAC_OFFSET;
+ if (mac_len % ETH_ALEN ||
+ mac_len > sizeof(fru_data.mac.macid))
+ return -EINVAL;
+
memcpy(&fru_data.mac.macid, mac->macid,
mac_len);
}
}
--
2.43.0
