According to SMBIOS Specification, section 6.1.3 Text Strings:
"Text strings associated with a given SMBIOS structure are returned in
the dmiStructBuffer, appended directly after the formatted portion of the
structure. This method of returning string information eliminates the
need for application software to deal with pointers embedded in the
SMBIOS structure. Each string is terminated with a null (00h) BYTE and
the set of strings is terminated with an additional null (00h) BYTE”
Furthermore:
"If the formatted portion of the structure contains string-reference
fields and all the string fields are set to 0 (no string references),
the formatted section of the structure is followed by two null (00h)
BYTES"
From the above it can be seen that any SMBIOS type which contains string
references should end with an additional zero byte.
This is currently handled in all SMBIOS types which use
load_str_field_with_default() besides type0.
Therefore, add the missing zero byte to SMBIOS Type 0.
Running QEMU with:
-machine pc-i440fx-2.0 (for legacy smbios)
-smbios type=0,vendor=,version=,date= (for zero str_index)
Will cause SMBIOS type0 entry to overrun type1 entry.
Reviewed-by: Ross Philipson <ross.philipson(a)oracle.com>
Reviewed-By: Liran Alon <liran.alon(a)oracle.com>
Signed-off-by: Sam Eiderman <shmuel.eiderman(a)oracle.com>
---
src/fw/smbios.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/fw/smbios.c b/src/fw/smbios.c
index f3b5ad9d..62a563b2 100644
--- a/src/fw/smbios.c
+++ b/src/fw/smbios.c
@@ -205,6 +205,10 @@ smbios_init_type_0(void *start)
*end = 0;
end++;
+ if (!str_index) {
+ *end = 0;
+ end++;
+ }
return end;
}
--
2.13.3
