firmware: dmi_scan: Prevent dmi_num integer overflow

dmi_num is a u16, dmi_len is a u32, so this construct:

	dmi_num = dmi_len / 4;

would result in an integer overflow for a DMI table larger than
256 kB. I've never see such a large table so far, but SMBIOS 3.0
makes it possible so maybe we'll see such tables in the future.

So instead of faking a structure count when the entry point does
not provide it, adjust the loop condition in dmi_table() to properly
deal with the case where dmi_num is not set.

This bug was introduced with the initial SMBIOS 3.0 support in commit
fc43026278b2 ("dmi: add support for SMBIOS 3.0 64-bit entry point").

Signed-off-by: Jean Delvare <[email protected]>
Cc: Matt Fleming <[email protected]>
Cc: Ivan Khoronzhuk <[email protected]>
Cc: <[email protected]>
Acked-by: Ard Biesheuvel <[email protected]>
Signed-off-by: Matt Fleming <[email protected]>

0 files changed, 0 insertions, 0 deletions