[PATCH ethtool 2/2] ethtool: validate module EEPROM offset and length

[Prabhakar Pujeri <prabhakar.pujeri@dell.com>]

do_getmodule() clamps a requested range by adding its offset and length.
An offset beyond the EEPROM makes the later subtraction underflow, while
a very large length can make the addition wrap.  Either case can produce
an unexpectedly large allocation request.

Reject offsets at or beyond the reported EEPROM size.  Once the offset is
known to be valid, compare the requested length with the remaining size
instead of adding the two user-controlled values.

Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
---
 ethtool.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ethtool.c b/ethtool.c
index 3076c12..fa0f729 100644
--- a/ethtool.c
+++ b/ethtool.c
@@ -5051,10 +5051,17 @@ static int do_getmodule(struct cmd_context *ctx)
 		return 1;
 	}
 
+	if (geeprom_offset >= modinfo.eeprom_len) {
+		fprintf(stderr,
+			"Invalid offset %u: module EEPROM is %u bytes\n",
+			geeprom_offset, modinfo.eeprom_len);
+		return 1;
+	}
+
 	if (!geeprom_length_seen)
 		geeprom_length = modinfo.eeprom_len;
 
-	if (modinfo.eeprom_len < geeprom_offset + geeprom_length)
+	if (geeprom_length > modinfo.eeprom_len - geeprom_offset)
 		geeprom_length = modinfo.eeprom_len - geeprom_offset;
 
 	eeprom = calloc(1, sizeof(*eeprom)+geeprom_length);
-- 
2.55.0