offset = 0;
tblcount = dmi->nstruc;
- while (offset+2 < dmi->tbllen && tblcount) {
+ while (offset+6 <= dmi->tbllen && tblcount--) {
table = (const struct dmi_table *)(dmi->tbladdr + offset);
+ if (table->type == 127) /* End of table */
+ break;
+
if (table->length < sizeof *table)
break; /* Invalid length */
return (const char *)table + base;
/* Search for a double NUL terminating the string table */
- while (offset+2 < dmi->tbllen &&
+ while (offset+2 <= dmi->tbllen &&
*(const uint16_t *)(dmi->tbladdr + offset) != 0)
offset++;
offset += 2;
- tblcount--;
}
return NULL;
offset = 0;
tblcount = dmi->nstruc;
- while (offset+2 < dmi->tbllen && tblcount) {
+ while (offset+6 <= dmi->tbllen && tblcount--) {
table = (const struct dmi_table *)(dmi->tbladdr + offset);
+ if (table->type == 127) /* End of table */
+ break;
+
if (table->length < sizeof *table)
break; /* Invalid length */
if (table->type == type && base < table->length) {
uint8_t index = ((const uint8_t *)table)[base];
const char *p = (const char *)table + table->length;
+ const char *str;
char c;
if (!index)
return NULL;
do {
- c = *p;
- if (++offset >= dmi->tbllen)
+ if (offset++ >= dmi->tbllen)
return NULL;
- p++;
+ c = *p++;
} while (c);
}
- return p;
+ /* Make sure the string is null-terminated */
+ str = p;
+ do {
+ if (offset++ >= dmi->tbllen)
+ return NULL;
+ c = *p++;
+ } while (c);
+ return str;
}
/* Search for a double NUL terminating the string table */
- while (offset+2 < dmi->tbllen &&
+ while (offset+2 <= dmi->tbllen &&
*(const uint16_t *)(dmi->tbladdr + offset) != 0)
offset++;
return NULL;
memcpy(q, pfx, pfxlen);
q += pfxlen;
- memcpy(q, str, ep-p);
+ memcpy(q, str, ep-str);
q += (ep-p);
*q = '\0';