[flashrom] [commit] r1763 - trunk

[repository service]

Author: stefanct
Date: Tue Oct 29 02:38:45 2013
New Revision: 1763
URL: http://flashrom.org/trac/flashrom/changeset/1763

Log:
Ensure DMI strings used in dmi_compare() are not NULL.

Previously the external DMI decoder did not allow this to happen because
all possible pointers were initialized at startup by the output of
'dmidecode -s ...' which has default values for all supported types.

The now active internal DMI decoder does work differently: it scans the
complete DMI table once and copies the available strings. Therefore, strings
that are not set by the firmware are left at their default value of NULL.

A segfault would arise if the following conditions are all true:
 - the firmware sets up a DMI/SMBIOS table which has at least a correct
   checksum, and
 - that table does *not* define at least one of the DMI strings we use
   for matching (as defined by dmi_strings[] in dmi.c), and
 - there exists a board enable whose PCI IDs are matched by the board,
   and which has a DMI string set that ends with a $ anchor, and
 - the user calls the internal programmer of flashrom without the
   optional mainboard parameter.

This was first observed by Gelip on an abit BF6 using the coreboot port
for the abit BE6-II V2.0.
The segfault was reproduced by Idwer Vollering on an ASUS F2A85-M with
the default DMI values of CONFIG_MAINBOARD_SMBIOS_MANUFACTURER etc.
overwritten and a forged board enable matching his board.
Idwer also verified that this patch fixes the problem, thanks a lot!

Signed-off-by: Stefan Tauner <stefan.tauner at student.tuwien.ac.at>
Acked-by: Stefan Tauner <stefan.tauner at student.tuwien.ac.at>

Modified:
   trunk/dmi.c

Modified: trunk/dmi.c
==============================================================================
--- trunk/dmi.c	Sat Oct 26 19:02:03 2013	(r1762)
+++ trunk/dmi.c	Tue Oct 29 02:38:45 2013	(r1763)
@@ -406,8 +406,8 @@
  * at the beginning and '$' at the end. So you can look for "^prefix",
  * "suffix$", "substring" or "^complete string$".
  *
- * @param value The string to check.
- * @param pattern The pattern.
+ * @param value The non-NULL string to check.
+ * @param pattern The non-NULL pattern.
  * @return Nonzero if pattern matches.
  */
 static int dmi_compare(const char *value, const char *pattern)
@@ -454,9 +454,13 @@
 	if (!has_dmi_support)
 		return 0;
 
-	for (i = 0; i < ARRAY_SIZE(dmi_strings); i++)
+	for (i = 0; i < ARRAY_SIZE(dmi_strings); i++) {
+		if (dmi_strings[i].value == NULL)
+			continue;
+
 		if (dmi_compare(dmi_strings[i].value, pattern))
 			return 1;
+	}
 
 	return 0;
 }