According to SMBIOS Specification, section 6.1.3 Text Strings: "Text strings associated with a given SMBIOS structure are returned in the dmiStructBuffer, appended directly after the formatted portion of the structure. This method of returning string information eliminates the need for application software to deal with pointers embedded in the SMBIOS structure. Each string is terminated with a null (00h) BYTE and the set of strings is terminated with an additional null (00h) BYTE”
Furthermore: "If the formatted portion of the structure contains string-reference fields and all the string fields are set to 0 (no string references), the formatted section of the structure is followed by two null (00h) BYTES"
From the above it can be seen that any SMBIOS type which contains string references should end with an additional zero byte.
This is currently handled in all SMBIOS types which use load_str_field_with_default() besides type0. Therefore, add the missing zero byte to SMBIOS Type 0.
Running QEMU with: -machine pc-i440fx-2.0 (for legacy smbios) -smbios type=0,vendor=,version=,date= (for zero str_index) Will cause SMBIOS type0 entry to overrun type1 entry.
Reviewed-by: Ross Philipson ross.philipson@oracle.com Reviewed-By: Liran Alon liran.alon@oracle.com Signed-off-by: Sam Eiderman shmuel.eiderman@oracle.com --- src/fw/smbios.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/src/fw/smbios.c b/src/fw/smbios.c index f3b5ad9d..62a563b2 100644 --- a/src/fw/smbios.c +++ b/src/fw/smbios.c @@ -205,6 +205,10 @@ smbios_init_type_0(void *start)
*end = 0; end++; + if (!str_index) { + *end = 0; + end++; + }
return end; }