diff mbox series

[v2,14/52] libflash/ipmi-hiomap: Enforce message size for empty response

Message ID 20190221062851.21958-15-andrew@aj.id.au
State Accepted
Headers show
Series ipmi-hiomap: Tests and fixes for event handling | expand

Commit Message

Andrew Jeffery Feb. 21, 2019, 6:28 a.m. UTC 
The protocol defines the response to the associated messages as empty
except for the command ID and sequence fields. If the BMC is returning
extra data consider the message malformed.

Cc: stable
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
---
 libflash/ipmi-hiomap.c | 6 ++++++
 1 file changed, 6 insertions(+)
diff mbox series

Patch

diff --git a/libflash/ipmi-hiomap.c b/libflash/ipmi-hiomap.c
index 7a36449a5d0b..56492fa87067 100644
--- a/libflash/ipmi-hiomap.c
+++ b/libflash/ipmi-hiomap.c
@@ -208,6 +208,12 @@  static void ipmi_hiomap_cmd_cb(struct ipmi_msg *msg)
 	case HIOMAP_C_FLUSH:
 	case HIOMAP_C_ACK:
 	case HIOMAP_C_ERASE:
+		if (msg->resp_size != 2) {
+			prerror("%u: Unexpected response size: %u\n", msg->data[0],
+				msg->resp_size);
+			res->cc = IPMI_ERR_UNSPECIFIED;
+			break;
+		}
 		break;
 	default:
 		prlog(PR_WARNING, "Unimplemented command handler: %u\n",