deepblue/ipmitool
1
0
Fork 0
mirror of https://github.com/ipmitool/ipmitool.git synced 2025-05-10 18:47:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lanplus: Realloc the msg if the payload_length gets updated

Browse Source 
It's possible the payload_length gets updated in
lanplus_encrypt_payload. If it's updated, the memory of msg should be
updated.

Tested: use ipmitool with lanplus with similar STR  and there is no
memory stomping issue.

Resolved: ipmitool/ipmitool#351
Signed-off-by: Tom Tung <shes050117@gmail.com>
This commit is contained in:
Tom Tung 2022-08-12 16:47:27 +08:00 committed by Alexander Amelkin
parent 63d59a50a6
commit 8f0946a81e
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/plugins/lanplus/lanplus.c
View File

@ -1727,6 +1727,7 @@ ipmi_lanplus_build_v2x_msg(
*/ */
if (session->v2_data.session_state == LANPLUS_STATE_ACTIVE) if (session->v2_data.session_state == LANPLUS_STATE_ACTIVE)
{ {
uint16_t old_payload_length = payload->payload_length;
/* Payload len is adjusted as necessary by lanplus_encrypt_payload */ /* Payload len is adjusted as necessary by lanplus_encrypt_payload */
lanplus_encrypt_payload(session->v2_data.crypt_alg, /* input */ lanplus_encrypt_payload(session->v2_data.crypt_alg, /* input */
session->v2_data.k2, /* input */ session->v2_data.k2, /* input */
@ -1735,6 +1736,24 @@ ipmi_lanplus_build_v2x_msg(
msg + IPMI_LANPLUS_OFFSET_PAYLOAD, /* output */ msg + IPMI_LANPLUS_OFFSET_PAYLOAD, /* output */
&(payload->payload_length)); /* output */ &(payload->payload_length)); /* output */
if (old_payload_length != payload->payload_length)
{
len =
IPMI_LANPLUS_OFFSET_PAYLOAD +
payload->payload_length +
IPMI_MAX_INTEGRITY_PAD_SIZE +
IPMI_LANPLUS_PAD_LENGTH_SIZE +
IPMI_LANPLUS_NEXT_HEADER_SIZE +
IPMI_MAX_AUTH_CODE_SIZE;
uint8_t * new_msg = realloc(msg, len);
if (!new_msg) {
free(msg);
lprintf(LOG_ERR, "ipmitool: realloc failure");
return;
}
msg = new_msg;
}
} }
/* Now we know the payload length */ /* Now we know the payload length */

2
src/plugins/lanplus/lanplus.h
View File

@ -86,6 +86,8 @@
#define IPMI_LANPLUS_OFFSET_PAYLOAD_SIZE 0x0E #define IPMI_LANPLUS_OFFSET_PAYLOAD_SIZE 0x0E
#define IPMI_LANPLUS_OFFSET_PAYLOAD 0x10 #define IPMI_LANPLUS_OFFSET_PAYLOAD 0x10
#define IPMI_LANPLUS_PAD_LENGTH_SIZE 1
#define IPMI_LANPLUS_NEXT_HEADER_SIZE 1
#define IPMI_GET_CHANNEL_AUTH_CAP 0x38 #define IPMI_GET_CHANNEL_AUTH_CAP 0x38