0021-hfsplus-Fix-two-more-overflows.patch 1.8 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. From feec993673d8e13fcf22fe2389ac29222b6daebd Mon Sep 17 00:00:00 2001
  2. From: Peter Jones <pjones@redhat.com>
  3. Date: Sun, 19 Jul 2020 14:43:31 -0400
  4. Subject: [PATCH] hfsplus: Fix two more overflows
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. Both node->size and node->namelen come from the supplied filesystem,
  9. which may be user-supplied. We can't trust them for the math unless we
  10. know they don't overflow. Making sure they go through grub_add() or
  11. grub_calloc() first will give us that.
  12. Signed-off-by: Peter Jones <pjones@redhat.com>
  13. Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
  14. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  15. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  16. ---
  17. grub-core/fs/hfsplus.c | 11 ++++++++---
  18. 1 file changed, 8 insertions(+), 3 deletions(-)
  19. diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
  20. index dae43becc..9c4e4c88c 100644
  21. --- a/grub-core/fs/hfsplus.c
  22. +++ b/grub-core/fs/hfsplus.c
  23. @@ -31,6 +31,7 @@
  24. #include <grub/hfs.h>
  25. #include <grub/charset.h>
  26. #include <grub/hfsplus.h>
  27. +#include <grub/safemath.h>
  28. GRUB_MOD_LICENSE ("GPLv3+");
  29. @@ -475,8 +476,12 @@ grub_hfsplus_read_symlink (grub_fshelp_node_t node)
  30. {
  31. char *symlink;
  32. grub_ssize_t numread;
  33. + grub_size_t sz = node->size;
  34. - symlink = grub_malloc (node->size + 1);
  35. + if (grub_add (sz, 1, &sz))
  36. + return NULL;
  37. +
  38. + symlink = grub_malloc (sz);
  39. if (!symlink)
  40. return 0;
  41. @@ -715,8 +720,8 @@ list_nodes (void *record, void *hook_arg)
  42. if (type == GRUB_FSHELP_UNKNOWN)
  43. return 0;
  44. - filename = grub_malloc (grub_be_to_cpu16 (catkey->namelen)
  45. - * GRUB_MAX_UTF8_PER_UTF16 + 1);
  46. + filename = grub_calloc (grub_be_to_cpu16 (catkey->namelen),
  47. + GRUB_MAX_UTF8_PER_UTF16 + 1);
  48. if (! filename)
  49. return 0;
  50. --
  51. 2.26.2