0107-fs-sfs-Fix-over-read-of-root-object-name.patch 1.8 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950
  1. From 8d3ae59dee2930d640add3bba983006e1f5dd1b6 Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Mon, 18 Jan 2021 14:34:58 +1100
  4. Subject: [PATCH] fs/sfs: Fix over-read of root object name
  5. There's a read of the name of the root object that assumes that the name
  6. is nul-terminated within the root block. This isn't guaranteed - it seems
  7. SFS would require you to read multiple blocks to get a full name in general,
  8. but maybe that doesn't apply to the root object.
  9. Either way, figure out how much space is left in the root block and don't
  10. over-read it. This fixes some OOB reads.
  11. Signed-off-by: Daniel Axtens <dja@axtens.net>
  12. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  13. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  14. ---
  15. grub-core/fs/sfs.c | 9 ++++++++-
  16. 1 file changed, 8 insertions(+), 1 deletion(-)
  17. diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
  18. index de2b107..983e880 100644
  19. --- a/grub-core/fs/sfs.c
  20. +++ b/grub-core/fs/sfs.c
  21. @@ -373,6 +373,7 @@ grub_sfs_mount (grub_disk_t disk)
  22. struct grub_sfs_objc *rootobjc;
  23. char *rootobjc_data = 0;
  24. grub_uint32_t blk;
  25. + unsigned int max_len;
  26. data = grub_malloc (sizeof (*data));
  27. if (!data)
  28. @@ -421,7 +422,13 @@ grub_sfs_mount (grub_disk_t disk)
  29. data->diropen.data = data;
  30. data->diropen.cache = 0;
  31. data->disk = disk;
  32. - data->label = grub_strdup ((char *) (rootobjc->objects[0].filename));
  33. +
  34. + /* We only read 1 block of data, so truncate the name if needed. */
  35. + max_len = ((GRUB_DISK_SECTOR_SIZE << data->log_blocksize)
  36. + - 24 /* offsetof (struct grub_sfs_objc, objects) */
  37. + - 25); /* offsetof (struct grub_sfs_obj, filename) */
  38. + data->label = grub_zalloc (max_len + 1);
  39. + grub_strncpy (data->label, (char *) rootobjc->objects[0].filename, max_len);
  40. grub_free (rootobjc_data);
  41. return data;
  42. --
  43. 2.14.2