On 9/22/26 08:54, Pranav Tilak wrote:
In fru_parse_multirec() the OEM MAC memcpy uses the EEPROM record length minus the IANA/version prefix with no check against the destination. A short record makes that length negative and it is converted to a large unsigned size by memcpy(), while an oversized record writes past the stored MAC array. Validate the OEM MAC record length before calculating the copy size. Return -EINVAL when the MAC payload is not a whole number of MAC addresses or exceeds the destination buffer. Fixes: 7a036b674fc8 ("fru: ops: Add support to read mac addresses from multirecord") Signed-off-by: Pranav Tilak <[email protected]> --- board/xilinx/common/fru_ops.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/board/xilinx/common/fru_ops.c b/board/xilinx/common/fru_ops.c index 610293bccf7..24b135f7666 100644 --- a/board/xilinx/common/fru_ops.c +++ b/board/xilinx/common/fru_ops.c @@ -260,8 +260,13 @@ static int fru_parse_multirec(unsigned long addr) if (CONFIG_IS_ENABLED(FRU_SC)) type = FRU_SC_MACID;- if (mac->ver == type) {+ if (mrc.len >= FRU_MULTIREC_MAC_OFFSET && + mac->ver == type) { mac_len = mrc.len - FRU_MULTIREC_MAC_OFFSET; + if (mac_len % ETH_ALEN || + mac_len > sizeof(fru_data.mac.macid)) + return -EINVAL; + memcpy(&fru_data.mac.macid, mac->macid, mac_len); } }
Applied. M
