[smbios] Avoid reading beyond end of constructed SMBIOS setting
Signed-off-by: Michael Brown <mcb30@ipxe.org>
diff --git a/src/interface/smbios/smbios_settings.c b/src/interface/smbios/smbios_settings.c
index ec31b43..ca3f2fe 100644
--- a/src/interface/smbios/smbios_settings.c
+++ b/src/interface/smbios/smbios_settings.c
@@ -130,6 +130,13 @@
return rc;
}
+ /* Limit length */
+ if ( tag_offset > sizeof ( buf ) ) {
+ tag_len = 0;
+ } else if ( ( tag_offset + tag_len ) > sizeof ( buf ) ) {
+ tag_len = ( sizeof ( buf ) - tag_offset );
+ }
+
/* Mangle UUIDs if necessary. iPXE treats UUIDs as
* being in network byte order (big-endian). SMBIOS
* specification version 2.6 states that UUIDs are
