Browse Source

[efi] Do not copy garbage bytes into SNP device path MAC address

The SNP device path includes the network device's MAC address within
the MAC_ADDR_DEVICE_PATH.MacAddress field.  We check that the
link-layer address will fit within this field, and then perform the
copy using the length of the destination buffer.

At 32 bytes, the MacAddress field is actually larger than the current
maximum iPXE link-layer address.  The copy therefore overflows the
source buffer, resulting in trailing garbage bytes being appended to
the device path's MacAddress.  This is invisible in debug messages,
since the DevicePathToText protocol will render only the length
implied by the interface type.

Fix by copying only the actual length of the link-layer address (which
we have already verified will not overflow the destination buffer).

Debugged-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 8 years ago
parent
commit
632e57f0f3
1 changed files with 1 additions and 1 deletions
  1. 1
    1
      src/interface/efi/efi_snp.c

+ 1
- 1
src/interface/efi/efi_snp.c View File

1651
 	macpath->Header.SubType = MSG_MAC_ADDR_DP;
1651
 	macpath->Header.SubType = MSG_MAC_ADDR_DP;
1652
 	macpath->Header.Length[0] = sizeof ( *macpath );
1652
 	macpath->Header.Length[0] = sizeof ( *macpath );
1653
 	memcpy ( &macpath->MacAddress, netdev->ll_addr,
1653
 	memcpy ( &macpath->MacAddress, netdev->ll_addr,
1654
-		 sizeof ( macpath->MacAddress ) );
1654
+		 netdev->ll_protocol->ll_addr_len );
1655
 	macpath->IfType = ntohs ( netdev->ll_protocol->ll_proto );
1655
 	macpath->IfType = ntohs ( netdev->ll_protocol->ll_proto );
1656
 	if ( ( tag = vlan_tag ( netdev ) ) ) {
1656
 	if ( ( tag = vlan_tag ( netdev ) ) ) {
1657
 		vlanpath = ( ( ( void * ) macpath ) + sizeof ( *macpath ) );
1657
 		vlanpath = ( ( ( void * ) macpath ) + sizeof ( *macpath ) );

Loading…
Cancel
Save