Subject: CVS commit: pkgsrc/sysutils/dmidecode
From: SAITOH Masanobu
Date: 2018-08-02 04:45:50
Message id: 20180802024551.10B17FBEC@cvs.NetBSD.org

Log Message:
 Add two officially recommended patch to sysutils/dmidecode

2018-08-01: Avoid OOB read on invalid entry point length

	Don't let the entry point checksum verification run beyond the end
	of the buffer holding it (32 bytes). This bug was discovered by
	Lionel Debroux using the AFL fuzzer and AddressSanitizer.
	Signed-off-by: Jean Delvare <jdelvare@suse.de>

2018-08-01: Validate structure completeness before decoding

	Ensure that the whole DMI structure fits in the announced table
	length before performing any action on it. Otherwise we might end
	up reading beyond the end of our memory buffer. This bug was
	discovered by Lionel Debroux using the AFL fuzzer and
	AddressSanitizer. Its probability is very low, as it requires a DMI
	table corrupted in one of two very specific ways to trigger. This
	bug exists since dmidecode version 2.9, although it is hard to
	test because option --from-dump was only introduced in version
	2.10.
	Signed-off-by: Jean Delvare <jdelvare@suse.de>

Files:
RevisionActionfile
1.22modifypkgsrc/sysutils/dmidecode/Makefile
1.19modifypkgsrc/sysutils/dmidecode/distinfo