0066-disk-cryptodisk-Fix-potential-integer-overflow.patch 1.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051
  1. From a201ad17caa430aa710654fdf2e6ab4c8166f031 Mon Sep 17 00:00:00 2001
  2. From: Darren Kenny <darren.kenny@oracle.com>
  3. Date: Thu, 21 Jan 2021 11:38:31 +0000
  4. Subject: [PATCH] disk/cryptodisk: Fix potential integer overflow
  5. The encrypt and decrypt functions expect a grub_size_t. So, we need to
  6. ensure that the constant bit shift is using grub_size_t rather than
  7. unsigned int when it is performing the shift.
  8. Fixes: CID 307788
  9. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  10. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  11. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  12. ---
  13. grub-core/disk/cryptodisk.c | 8 ++++----
  14. 1 file changed, 4 insertions(+), 4 deletions(-)
  15. diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
  16. index 5037768..6883f48 100644
  17. --- a/grub-core/disk/cryptodisk.c
  18. +++ b/grub-core/disk/cryptodisk.c
  19. @@ -311,10 +311,10 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev,
  20. case GRUB_CRYPTODISK_MODE_CBC:
  21. if (do_encrypt)
  22. err = grub_crypto_cbc_encrypt (dev->cipher, data + i, data + i,
  23. - (1U << dev->log_sector_size), iv);
  24. + ((grub_size_t) 1 << dev->log_sector_size), iv);
  25. else
  26. err = grub_crypto_cbc_decrypt (dev->cipher, data + i, data + i,
  27. - (1U << dev->log_sector_size), iv);
  28. + ((grub_size_t) 1 << dev->log_sector_size), iv);
  29. if (err)
  30. return err;
  31. break;
  32. @@ -322,10 +322,10 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev,
  33. case GRUB_CRYPTODISK_MODE_PCBC:
  34. if (do_encrypt)
  35. err = grub_crypto_pcbc_encrypt (dev->cipher, data + i, data + i,
  36. - (1U << dev->log_sector_size), iv);
  37. + ((grub_size_t) 1 << dev->log_sector_size), iv);
  38. else
  39. err = grub_crypto_pcbc_decrypt (dev->cipher, data + i, data + i,
  40. - (1U << dev->log_sector_size), iv);
  41. + ((grub_size_t) 1 << dev->log_sector_size), iv);
  42. if (err)
  43. return err;
  44. break;
  45. --
  46. 2.14.2