diff options
author | Alexander Amelkin <alexander@amelkin.msk.ru> | 2020-09-15 16:49:20 +0300 |
---|---|---|
committer | Alexander Amelkin <mocbuhtig@amelkin.msk.ru> | 2020-09-16 13:26:53 +0300 |
commit | 1245aaa387dca1cb99408869b2c1b3e2410a1352 (patch) | |
tree | 05d012c2998927acc694b839650b456db4695b61 | |
parent | 50d8c36edf9657720e25445a435dabc44572cf5f (diff) | |
download | ipmitool-1245aaa387dca1cb99408869b2c1b3e2410a1352.tar.gz |
fru: Fix crashes on 6-bit ASCII strings
Fix calculation of the buffer size for decoded 6-bit ASCII
strings. Previously the program could allocate too a short buffer
that caused buffer overflows and segmentation fault crashes on
certain FRU contents.
Signed-off-by: Alexander Amelkin <alexander@amelkin.msk.ru>
-rw-r--r-- | lib/ipmi_fru.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/ipmi_fru.c b/lib/ipmi_fru.c index 501ef26..3d1d8a1 100644 --- a/lib/ipmi_fru.c +++ b/lib/ipmi_fru.c @@ -175,8 +175,8 @@ char * get_fru_area_str(uint8_t * data, uint32_t * offset) size = (len * 2); break; case 2: /* 10b: 6-bit ASCII */ - /* 4 chars per group of 1-3 bytes */ - size = (((len * 4 + 2) / 3) & ~3); + /* 4 chars per group of 1-3 bytes, round up to 4 bytes boundary */ + size = (len / 3 + 1) * 4; break; case 3: /* 11b: 8-bit ASCII */ /* no length adjustment */ |