smbios: buffer overflow when zeroing entry point

A SMBIOS 3 entry point has a different length than an SMBIOS 2.1 entry
point.

Fixes: 70924294f375 ("smbios: Use SMBIOS 3.0 to support an address above 4GB")
Fixes: 1c5f6fa3883d ("smbios: Drop support for SMBIOS2 tables")
Addresses-Coverity-ID: 477212 ("Wrong sizeof argument")
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>

diff --git a/lib/smbios.c b/lib/smbios.c
index 41aa936c4c41e7567fa0c1f04b06508dfbf6c759..25595f55ab75e4260da7ab20f9347241d9a33f28 100644 (file)
--- a/lib/smbios.c
+++ b/lib/smbios.c
@@ -591,8 +591,8 @@ ulong write_smbios_table(ulong addr)
        table_addr = (ulong)map_sysmem(tables, 0);
 
        /* now go back and write the SMBIOS3 header */
-       se = map_sysmem(start_addr, sizeof(struct smbios_entry));
-       memset(se, '\0', sizeof(struct smbios_entry));
+       se = map_sysmem(start_addr, sizeof(struct smbios3_entry));
+       memset(se, '\0', sizeof(struct smbios3_entry));
        memcpy(se->anchor, "_SM3_", 5);
        se->length = sizeof(struct smbios3_entry);
        se->major_ver = SMBIOS_MAJOR_VER;