0012-term-Fix-overflow-on-user-inputs.patch 2.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869
  1. From 8d3b6f9da468f666e3a7976657f2ab5c52762a21 Mon Sep 17 00:00:00 2001
  2. From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
  3. Date: Tue, 7 Jul 2020 15:12:25 -0400
  4. Subject: [PATCH] term: Fix overflow on user inputs
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. This requires a very weird input from the serial interface but can cause
  9. an overflow in input_buf (keys) overwriting the next variable (npending)
  10. with the user choice:
  11. (pahole output)
  12. struct grub_terminfo_input_state {
  13. int input_buf[6]; /* 0 24 */
  14. int npending; /* 24 4 */ <- CORRUPT
  15. ...snip...
  16. The magic string requires causing this is "ESC,O,],0,1,2,q" and we overflow
  17. npending with "q" (aka increase npending to 161). The simplest fix is to
  18. just to disallow overwrites input_buf, which exactly what this patch does.
  19. Fixes: CID 292449
  20. Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
  21. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  22. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  23. ---
  24. grub-core/term/terminfo.c | 9 ++++++---
  25. 1 file changed, 6 insertions(+), 3 deletions(-)
  26. diff --git a/grub-core/term/terminfo.c b/grub-core/term/terminfo.c
  27. index d317efa36..5fa94c0c3 100644
  28. --- a/grub-core/term/terminfo.c
  29. +++ b/grub-core/term/terminfo.c
  30. @@ -398,7 +398,7 @@ grub_terminfo_getwh (struct grub_term_output *term)
  31. }
  32. static void
  33. -grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len,
  34. +grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len, int max_len,
  35. int (*readkey) (struct grub_term_input *term))
  36. {
  37. int c;
  38. @@ -414,6 +414,9 @@ grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len,
  39. if (c == -1) \
  40. return; \
  41. \
  42. + if (*len >= max_len) \
  43. + return; \
  44. + \
  45. keys[*len] = c; \
  46. (*len)++; \
  47. }
  48. @@ -602,8 +605,8 @@ grub_terminfo_getkey (struct grub_term_input *termi)
  49. return ret;
  50. }
  51. - grub_terminfo_readkey (termi, data->input_buf,
  52. - &data->npending, data->readkey);
  53. + grub_terminfo_readkey (termi, data->input_buf, &data->npending,
  54. + GRUB_TERMINFO_READKEY_MAX_LEN, data->readkey);
  55. #if defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275)
  56. if (data->npending == 1 && data->input_buf[0] == GRUB_TERM_ESC
  57. --
  58. 2.26.2