0103-fs-fshelp-Catch-impermissibly-large-block-sizes-in-r.patch 1.6 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647
  1. From b5bc456f664bc301ab4cd5a17d3d23c6661c259e Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Mon, 18 Jan 2021 11:46:39 +1100
  4. Subject: [PATCH] fs/fshelp: Catch impermissibly large block sizes in read
  5. helper
  6. A fuzzed HFS+ filesystem had log2blocksize = 22. This gave
  7. log2blocksize + GRUB_DISK_SECTOR_BITS = 31. 1 << 31 = 0x80000000,
  8. which is -1 as an int. This caused some wacky behavior later on in
  9. the function, leading to out-of-bounds writes on the destination buffer.
  10. Catch log2blocksize + GRUB_DISK_SECTOR_BITS >= 31. We could be stricter,
  11. but this is the minimum that will prevent integer size weirdness.
  12. Signed-off-by: Daniel Axtens <dja@axtens.net>
  13. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  14. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  15. ---
  16. grub-core/fs/fshelp.c | 12 ++++++++++++
  17. 1 file changed, 12 insertions(+)
  18. diff --git a/grub-core/fs/fshelp.c b/grub-core/fs/fshelp.c
  19. index 4c902ad..a2d0d29 100644
  20. --- a/grub-core/fs/fshelp.c
  21. +++ b/grub-core/fs/fshelp.c
  22. @@ -362,6 +362,18 @@ grub_fshelp_read_file (grub_disk_t disk, grub_fshelp_node_t node,
  23. grub_disk_addr_t i, blockcnt;
  24. int blocksize = 1 << (log2blocksize + GRUB_DISK_SECTOR_BITS);
  25. + /*
  26. + * Catch blatantly invalid log2blocksize. We could be a lot stricter, but
  27. + * this is the most permissive we can be before we start to see integer
  28. + * overflow/underflow issues.
  29. + */
  30. + if (log2blocksize + GRUB_DISK_SECTOR_BITS >= 31)
  31. + {
  32. + grub_error (GRUB_ERR_OUT_OF_RANGE,
  33. + N_("blocksize too large"));
  34. + return -1;
  35. + }
  36. +
  37. if (pos > filesize)
  38. {
  39. grub_error (GRUB_ERR_OUT_OF_RANGE,
  40. --
  41. 2.14.2