summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2019-10-15 09:20:07 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2019-10-15 09:20:07 -0700
commit37b238da15a87a0be1cdda09e4aa8a5bc2b4d759 (patch)
treea5085061cde85cb8f231458c0746876e96b83b39
parent5bc52f64e8841c4526d74f1073bfa95d4f6224d4 (diff)
parent81dde26de9c08bb04c4962a15608778aaffb3cf9 (diff)
downloadlinux-37b238da15a87a0be1cdda09e4aa8a5bc2b4d759.tar.bz2
Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging
Pull dmi fix from Jean Delvare. * 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
-rw-r--r--drivers/firmware/dmi_scan.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 35ed56b9c34f..1e21fc3e9851 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -408,7 +408,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
bytes = ~0ull;
else if (size & 0x8000)
bytes = (u64)(size & 0x7fff) << 10;
- else if (size != 0x7fff)
+ else if (size != 0x7fff || dm->length < 0x20)
bytes = (u64)size << 20;
else
bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;