static buffer overflow in fwum (firmBuf)

[wdoekes]

See:

ipmitool/lib/ipmi_fwum.c

Line 49 in 19d7878

unsigned char firmBuf[1024*512];

and

ipmitool/lib/ipmi_fwum.c

Line 357 in 19d7878

if (fread(&firmBuf[qty * MAX_BUFFER_SIZE], 1,

In that latter bit, it just keeps reading, even though there is room for only (512*1024)/(16*1024) = 32 x 16k reads (max. 512k).

Trying to read something large yields an immediate abort or segfault:

(gdb) run fwum download SMM_X9_2_60.ima
Starting program: /usr/bin/ipmitool fwum download SMM_X9_2_60.ima

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
FWUM extension Version 1.3
Firmware File Name         : SMM_X9_2_60.ima
Fatal error: glibc detected an invalid stdio handle                       0 %

Program received signal SIGABRT, Aborted.

(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff745b537 in __GI_abort () at abort.c:79
#2  0x00007ffff74b4768 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff75c2a53 "%s") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007ffff74b4792 in __GI___libc_fatal (message=message@entry=0x7ffff75c4d10 "Fatal error: glibc detected an invalid stdio handle\n") at ../sysdeps/posix/libc_fatal.c:164
#4  0x00007ffff74b4fc5 in _IO_vtable_check () at vtables.c:72
#5  0x00007ffff74b8c8c in IO_validate_vtable (vtable=0xffffffffffffffff) at libioP.h:947
#6  __GI__IO_sgetn (fp=0x5555556c4720, data=0x5555556c4ce0, n=16384) at genops.c:411
#7  0x00007ffff74ab11f in __GI__IO_fread (buf=buf@entry=0x5555556c4ce0, size=size@entry=1, count=count@entry=16384, fp=fp@entry=0x5555556c4720) at iofread.c:38
#8  0x00005555555a4f6a in fread (__stream=0x5555556c4720, __n=16384, __size=1, __ptr=0x5555556c4ce0) at /usr/include/x86_64-linux-gnu/bits/stdio2.h:297
#9  KfwumSetupBuffersFromFile (pFileName=pFileName@entry=0x7fffffffe798 "SMM_X9_2_60.ima", fileSize=<optimized out>) at ipmi_fwum.c:357
#10 0x00005555555a6455 in ipmi_fwum_fwupgrade (intf=0x55555563ee20 <ipmi_open_intf>, file=0x7fffffffe798 "SMM_X9_2_60.ima", action=0) at ipmi_fwum.c:268
#11 0x00005555555ac5a8 in ipmi_main (argc=<optimized out>, argv=<optimized out>, cmdlist=cmdlist@entry=0x555555632020 <ipmitool_cmd_list>, intflist=intflist@entry=0x0)
    at ipmi_main.c:1004
#12 0x000055555556eb62 in main (argc=<optimized out>, argv=<optimized out>) at ipmitool.c:135

Observed with debian/bullseye ipmitool 1.8.18-10.1.