0147-gfxmenu-gui-Check-printf-format-in-the-gui_progress_.patch 2.3 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162
  1. From 42facd577231cf5ffe4c7128fed15b7e7d99cbca Mon Sep 17 00:00:00 2001
  2. From: Thomas Frauendorfer | Miray Software <tf@miray.de>
  3. Date: Tue, 4 Aug 2020 13:49:51 +0200
  4. Subject: [PATCH] gfxmenu/gui: Check printf() format in the gui_progress_bar
  5. and gui_label
  6. The gui_progress_bar and gui_label components can display the timeout
  7. value. The format string can be set through a theme file. This patch
  8. adds a validation step to the format string.
  9. If a user loads a theme file into the GRUB without this patch then
  10. a GUI label with the following settings
  11. + label {
  12. ...
  13. id = "__timeout__"
  14. text = "%s"
  15. }
  16. will interpret the current timeout value as string pointer and print the
  17. memory at that position on the screen. It is not desired behavior.
  18. Signed-off-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
  19. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  20. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  21. ---
  22. grub-core/gfxmenu/gui_label.c | 4 ++++
  23. grub-core/gfxmenu/gui_progress_bar.c | 3 +++
  24. 2 files changed, 7 insertions(+)
  25. diff --git a/grub-core/gfxmenu/gui_label.c b/grub-core/gfxmenu/gui_label.c
  26. index a4c8178..1c19054 100644
  27. --- a/grub-core/gfxmenu/gui_label.c
  28. +++ b/grub-core/gfxmenu/gui_label.c
  29. @@ -193,6 +193,10 @@ label_set_property (void *vself, const char *name, const char *value)
  30. else if (grub_strcmp (value, "@KEYMAP_SHORT@") == 0)
  31. value = _("enter: boot, `e': options, `c': cmd-line");
  32. /* FIXME: Add more templates here if needed. */
  33. +
  34. + if (grub_printf_fmt_check(value, "%d") != GRUB_ERR_NONE)
  35. + value = ""; /* Unsupported format. */
  36. +
  37. self->template = grub_strdup (value);
  38. self->text = grub_xasprintf (value, self->value);
  39. }
  40. diff --git a/grub-core/gfxmenu/gui_progress_bar.c b/grub-core/gfxmenu/gui_progress_bar.c
  41. index b128f08..ace85a1 100644
  42. --- a/grub-core/gfxmenu/gui_progress_bar.c
  43. +++ b/grub-core/gfxmenu/gui_progress_bar.c
  44. @@ -348,6 +348,9 @@ progress_bar_set_property (void *vself, const char *name, const char *value)
  45. Please use the shortest form available in you language. */
  46. value = _("%ds");
  47. + if (grub_printf_fmt_check(value, "%d") != GRUB_ERR_NONE)
  48. + value = ""; /* Unsupported format. */
  49. +
  50. self->template = grub_strdup (value);
  51. }
  52. else if (grub_strcmp (name, "font") == 0)
  53. --
  54. 2.14.2