Chrostoper Ertl 7ccea283dd
fru, sdr: Fix id_string buffer overflows
Final part of the fixes for CVE-2020-5208, see
https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp

9 variants of stack buffer overflow when parsing `id_string` field of
SDR records returned from `CMD_GET_SDR` command.

SDR record structs have an `id_code` field, and an `id_string` `char`
array.

The length of `id_string` is calculated as `(id_code & 0x1f) + 1`,
which can be larger than expected 16 characters (if `id_code = 0xff`,
then length will be `(0xff & 0x1f) + 1 = 32`).

In numerous places, this can cause stack buffer overflow when copying
into fixed buffer of size `17` bytes from this calculated length.
2020-02-04 15:00:14 +03:00
..
2020-02-04 14:59:52 +03:00
2019-06-18 16:43:41 +03:00
2019-03-04 12:22:23 +03:00
2018-08-21 17:30:25 +03:00
2019-06-18 16:43:41 +03:00