From 55e8cdff14435ddb056440b3d962eded453d2b22 Mon Sep 17 00:00:00 2001 From: Olivier Certner Date: Mon, 3 Mar 2025 15:25:23 +0100 Subject: [PATCH] smbios: Harden decoding of the BCD revision bcd2bin() must not be called with a value greater or equal to LIBKERN_LEN_BCD2BIN. MFC after: 2 weeks Sponsored by: The FreeBSD Foundation (cherry picked from commit 516e24e57987d184cce70e7f31443653aa1a5e63) --- sys/dev/smbios/smbios.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/sys/dev/smbios/smbios.c b/sys/dev/smbios/smbios.c index c8536d5f86c..24e110f722d 100644 --- a/sys/dev/smbios/smbios.c +++ b/sys/dev/smbios/smbios.c @@ -242,18 +242,20 @@ smbios_attach (device_t dev) "Docrev: %u, Entry Point Revision: %u\n", sc->eps3->docrev, sc->eps3->entry_point_revision); } else { + const struct smbios_eps *const eps = va; + const uint8_t bcd = eps->BCD_revision; + sc->eps = va; device_printf(dev, "Entry point: v2.1 (32-bit), Version: %u.%u", - sc->eps->major_version, sc->eps->minor_version); - if (bcd2bin(sc->eps->BCD_revision)) + eps->major_version, eps->minor_version); + if (bcd < LIBKERN_LEN_BCD2BIN && bcd2bin(bcd) != 0) printf(", BCD Revision: %u.%u\n", - bcd2bin(sc->eps->BCD_revision >> 4), - bcd2bin(sc->eps->BCD_revision & 0x0f)); + bcd2bin(bcd >> 4), bcd2bin(bcd & 0x0f)); else printf("\n"); if (bootverbose) device_printf(dev, "Entry Point Revision: %u\n", - sc->eps->entry_point_revision); + eps->entry_point_revision); } return (0); }