Description of problem:

We have a customer reporting a crash when issuing "ipmitool sdr list", on RHEL7, but the code is expected to die similarly on RHEL8 since code is similar.
Digging into this, I could find out the following sdr percentage being returned:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
(gdb) p sr.full->cmn.unit
$6 = {pct = 0 '\000', modifier = 0 '\000', rate = 0 '\000', analog = 0 '\000', type = {base = 112 'p', modifier = 0 '\000'}}
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Here above we have "type.base" == 112.

The code failing is:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
1397 struct sensor_reading *
1398 ipmi_sdr_read_sensor_value(struct ipmi_intf *intf,
1399                  struct sdr_record_common_sensor *sensor,
1400                  uint8_t sdr_record_type, int precision)
1401 {
 :
1496                 /* determine units string with possible modifiers */
1497                 sr.s_a_units = ipmi_sdr_get_unit_string(sr.full->cmn.unit.pct,
1498                                            sr.full->cmn.unit.modifier,
1499 >>> HERE                                   sr.full->cmn.unit.type.base,
1500                                            sr.full->cmn.unit.type.modifier);
 :

  77 /* ipmi_sdr_get_unit_string  -  return units for base/modifier
  78  *
  79  * @pct:        units are a percentage
  80  * @type:       unit type
  81  * @base:       base
  82  * @modifier:   modifier
  83  *
  84  * returns pointer to static string
  85  */
  86 const char *
  87 ipmi_sdr_get_unit_string(uint8_t pct, uint8_t type, uint8_t base, uint8_t modifier)
  88 {
  :
  94         char *pctstr = pct ? "% " : "";
  :
  96         switch (type) {
  :
 105         case 0:
 106         default:
  :
 114                         snprintf(unitstr, sizeof (unitstr), "%s%s",
 115 >>> HERE                         pctstr, unit_desc[base]);
 :
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Here above we see a "unit_desc[base]" is performed, hence here "unit_desc[112]" which is out of range:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
777 /* unit description codes (IPMI v1.5 section 37.16) */
778 #define UNIT_MAX        0x90
779 static const char *unit_desc[] __attribute__ ((unused)) = {
780 "unspecified",
781             "degrees C", "degrees F", "degrees K",
782             "Volts", "Amps", "Watts", "Joules",
783             "Coulombs", "VA", "Nits",
784             "lumen", "lux", "Candela",
785             "kPa", "PSI", "Newton",
786             "CFM", "RPM", "Hz",
787             "microsecond", "millisecond", "second", "minute", "hour",
788             "day", "week", "mil", "inches", "feet", "cu in", "cu feet",
789             "mm", "cm", "m", "cu cm", "cu m", "liters", "fluid ounce",
790             "radians", "steradians", "revolutions", "cycles",
791             "gravities", "ounce", "pound", "ft-lb", "oz-in", "gauss",
792             "gilberts", "henry", "millihenry", "farad", "microfarad",
793             "ohms", "siemens", "mole", "becquerel", "PPM", "reserved",
794             "Decibels", "DbA", "DbC", "gray", "sievert",
795             "color temp deg K", "bit", "kilobit", "megabit", "gigabit",
796             "byte", "kilobyte", "megabyte", "gigabyte", "word", "dword",
797             "qword", "line", "hit", "miss", "retry", "reset",
798             "overflow", "underrun", "collision", "packets", "messages",
799             "characters", "error", "correctable error", "uncorrectable error",};
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

See https://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/second-gen-interface-spec-v1.5-rev1.1-2.pdf page 416 for the table in the specification.

There are 2 issues here:
1. "UNIT_MAX" is 90 in decimal, not 0x90 as in the code
2. There is no check made to see if "type.base" is greater or equal to "UNIT_MAX" ("UNIT_MAX" is just not used anywhere in the code)

Version-Release number of selected component (if applicable):

ipmitool RHEL7+

How reproducible:

Don't know, I don't have the hardware.