0025-efi-chainloader-Propagate-errors-from-copy_file_path.patch 2.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778
  1. From fb55bc37dd510911df4eaf649da939f5fafdc7ce Mon Sep 17 00:00:00 2001
  2. From: Daniel Kiper <daniel.kiper@oracle.com>
  3. Date: Wed, 29 Jul 2020 13:38:31 +0200
  4. Subject: [PATCH] efi/chainloader: Propagate errors from copy_file_path()
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. Without any error propagated to the caller, make_file_path()
  9. would then try to advance the invalid device path node with
  10. GRUB_EFI_NEXT_DEVICE_PATH(), which would fail, returning a NULL
  11. pointer that would subsequently be dereferenced. Hence, propagate
  12. errors from copy_file_path().
  13. Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
  14. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  15. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  16. ---
  17. grub-core/loader/efi/chainloader.c | 19 +++++++++++++------
  18. 1 file changed, 13 insertions(+), 6 deletions(-)
  19. diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
  20. index a8d7b9155..7b31c3fb9 100644
  21. --- a/grub-core/loader/efi/chainloader.c
  22. +++ b/grub-core/loader/efi/chainloader.c
  23. @@ -106,7 +106,7 @@ grub_chainloader_boot (void)
  24. return grub_errno;
  25. }
  26. -static void
  27. +static grub_err_t
  28. copy_file_path (grub_efi_file_path_device_path_t *fp,
  29. const char *str, grub_efi_uint16_t len)
  30. {
  31. @@ -118,7 +118,7 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
  32. path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name));
  33. if (!path_name)
  34. - return;
  35. + return grub_error (GRUB_ERR_OUT_OF_MEMORY, "failed to allocate path buffer");
  36. size = grub_utf8_to_utf16 (path_name, len * GRUB_MAX_UTF16_PER_UTF8,
  37. (const grub_uint8_t *) str, len, 0);
  38. @@ -131,6 +131,7 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
  39. fp->path_name[size++] = '\0';
  40. fp->header.length = size * sizeof (grub_efi_char16_t) + sizeof (*fp);
  41. grub_free (path_name);
  42. + return GRUB_ERR_NONE;
  43. }
  44. static grub_efi_device_path_t *
  45. @@ -189,13 +190,19 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
  46. d = (grub_efi_device_path_t *) ((char *) file_path
  47. + ((char *) d - (char *) dp));
  48. grub_efi_print_device_path (d);
  49. - copy_file_path ((grub_efi_file_path_device_path_t *) d,
  50. - dir_start, dir_end - dir_start);
  51. + if (copy_file_path ((grub_efi_file_path_device_path_t *) d,
  52. + dir_start, dir_end - dir_start) != GRUB_ERR_NONE)
  53. + {
  54. + fail:
  55. + grub_free (file_path);
  56. + return 0;
  57. + }
  58. /* Fill the file path for the file. */
  59. d = GRUB_EFI_NEXT_DEVICE_PATH (d);
  60. - copy_file_path ((grub_efi_file_path_device_path_t *) d,
  61. - dir_end + 1, grub_strlen (dir_end + 1));
  62. + if (copy_file_path ((grub_efi_file_path_device_path_t *) d,
  63. + dir_end + 1, grub_strlen (dir_end + 1)) != GRUB_ERR_NONE)
  64. + goto fail;
  65. /* Fill the end of device path nodes. */
  66. d = GRUB_EFI_NEXT_DEVICE_PATH (d);
  67. --
  68. 2.26.2