2871621518
commit 4b708b7b1a2c09fbdfff6b942ebe3a160213aacd upstream.
The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.
To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.
Fixes: ad2ac9d5c5 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin <hungte@chromium.org>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
59 lines
1.5 KiB
C
59 lines
1.5 KiB
C
/*
|
|
* vpd_decode.h
|
|
*
|
|
* Google VPD decoding routines.
|
|
*
|
|
* Copyright 2017 Google Inc.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License v2.0 as published by
|
|
* the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*/
|
|
|
|
#ifndef __VPD_DECODE_H
|
|
#define __VPD_DECODE_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
enum {
|
|
VPD_OK = 0,
|
|
VPD_FAIL,
|
|
};
|
|
|
|
enum {
|
|
VPD_TYPE_TERMINATOR = 0,
|
|
VPD_TYPE_STRING,
|
|
VPD_TYPE_INFO = 0xfe,
|
|
VPD_TYPE_IMPLICIT_TERMINATOR = 0xff,
|
|
};
|
|
|
|
/* Callback for vpd_decode_string to invoke. */
|
|
typedef int vpd_decode_callback(const u8 *key, u32 key_len,
|
|
const u8 *value, u32 value_len,
|
|
void *arg);
|
|
|
|
/*
|
|
* vpd_decode_string
|
|
*
|
|
* Given the encoded string, this function invokes callback with extracted
|
|
* (key, value). The *consumed will be plused the number of bytes consumed in
|
|
* this function.
|
|
*
|
|
* The input_buf points to the first byte of the input buffer.
|
|
*
|
|
* The *consumed starts from 0, which is actually the next byte to be decoded.
|
|
* It can be non-zero to be used in multiple calls.
|
|
*
|
|
* If one entry is successfully decoded, sends it to callback and returns the
|
|
* result.
|
|
*/
|
|
int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
|
|
vpd_decode_callback callback, void *callback_arg);
|
|
|
|
#endif /* __VPD_DECODE_H */
|