From 7a332d757d2bec6d1c5433a807ceceb0cf96e00c Mon Sep 17 00:00:00 2001 From: qihao Date: Tue, 27 Feb 2024 10:22:18 +0800 Subject: [PATCH] hw/smbios: Fix OEM strings table option validation cheery-pick from e8ddec58053e9361b2cc18ec6d17b6c95590bf3c qemu_smbios_type11_opts did not have the list terminator and that resulted in out-of-bound memory access. It also needs to have an element for the type option. Cc: qemu-stable@nongnu.org Fixes: 2d6dcbf93fb0 ("smbios: support setting OEM strings table") Signed-off-by: Akihiko Odaki Reviewed-by: Michael Tokarev Message-Id: <20240129-smbios-v2-1-9ee6fede0d10@daynix.com> Reviewed-by: Ani Sinha Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Signed-off-by: qihao_yewu --- hw/smbios/smbios.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c index 66be9aee09..f73b9417c8 100644 --- a/hw/smbios/smbios.c +++ b/hw/smbios/smbios.c @@ -332,6 +332,11 @@ static const QemuOptDesc qemu_smbios_type4_opts[] = { }; static const QemuOptDesc qemu_smbios_type11_opts[] = { + { + .name = "type", + .type = QEMU_OPT_NUMBER, + .help = "SMBIOS element type", + }, { .name = "value", .type = QEMU_OPT_STRING, @@ -342,6 +347,7 @@ static const QemuOptDesc qemu_smbios_type11_opts[] = { .type = QEMU_OPT_STRING, .help = "OEM string data from file", }, + { /* end of list */ } }; static const QemuOptDesc qemu_smbios_type17_opts[] = { -- 2.27.0