commit c178948eae0378e4b7a15f85ff95591033e56dce
author Meera-Katta <meerax.katta@linux.intel.com> Tue May 18 09:53:26 2021 +0000
committer Vernon Mauery <vernon.mauery@linux.intel.com> Wed Jul 21 00:26:21 2021 +0000
tree 6b8b11a3c2be0ea846578e3de9e526e2c6020e7b
parent 55f5d53c0f4fbf5c98d19315c0a3312479e0142f

Fix for not allow out-of-bounds read in IPMI chnl

Issue: As IPMI channel number assignment starts from 0 to 15, user can
access channel numbers from 0-15 only. If user tried to access IPMI
channel number 16, not throwing out of range error message to the user.
From channel number 17 onwards only throwing out of range error message
to the user.

Fix: Added check to throw out of range error message to the user,
when tried to access channel number equal to or greater than 16.

Tested: Verified using ipmitool raw commands by hacking channel number
to 16 (as IPMI channel_number parameter size is only 4-bits for most of
the IPMI commands) and verified error message.

Signed-off-by: Meera-Katta <meerax.katta@linux.intel.com>
Change-Id: Iac3d8e66bd8cfbbb67aa403f3e19ae18347ea03b

apphandler.cpp

diff --git a/apphandler.cpp b/apphandler.cpp
index cbf7fcf..f5db550 100644
--- a/apphandler.cpp
+++ b/apphandler.cpp
@@ -939,7 +939,7 @@
 
 uint8_t getTotalSessionCount()
 {
-    uint8_t count = 0, ch = 1;
+    uint8_t count = 0, ch = 0;
 
     while (ch < ipmi::maxIpmiChannels &&
            count < session::maxNetworkInstanceSupported)

user_channel/channel_mgmt.cpp

diff --git a/user_channel/channel_mgmt.cpp b/user_channel/channel_mgmt.cpp
index a1a9051..5f44818 100644
--- a/user_channel/channel_mgmt.cpp
+++ b/user_channel/channel_mgmt.cpp
@@ -352,7 +352,7 @@
 
 bool ChannelConfig::isValidChannel(const uint8_t chNum)
 {
-    if (chNum > maxIpmiChannels)
+    if (chNum >= maxIpmiChannels)
     {
         log<level::DEBUG>("Invalid channel ID - Out of range");
         return false;
@@ -1022,7 +1022,7 @@
         {
             std::string chKey = it.key();
             uint8_t chNum = std::stoi(chKey, nullptr, 10);
-            if ((chNum < 0) || (chNum > maxIpmiChannels))
+            if (chNum >= maxIpmiChannels)
             {
                 log<level::DEBUG>(
                     "Invalid channel access entry in config file");
@@ -1090,7 +1090,7 @@
         {
             std::string chKey = it.key();
             uint8_t chNum = std::stoi(chKey, nullptr, 10);
-            if ((chNum < 0) || (chNum > maxIpmiChannels))
+            if (chNum >= maxIpmiChannels)
             {
                 log<level::DEBUG>(
                     "Invalid channel access entry in config file");