0082-video-fb-video_fb-Fix-possible-integer-overflow.patch 1.3 KB

12345678910111213141516171819202122232425262728293031323334353637383940
  1. From 08413f2f4edec0e2d9bf15f836f6ee5ca2e379cb Mon Sep 17 00:00:00 2001
  2. From: Darren Kenny <darren.kenny@oracle.com>
  3. Date: Fri, 4 Dec 2020 14:51:30 +0000
  4. Subject: [PATCH] video/fb/video_fb: Fix possible integer overflow
  5. It is minimal possibility that the values being used here will overflow.
  6. So, change the code to use the safemath function grub_mul() to ensure
  7. that doesn't happen.
  8. Fixes: CID 73761
  9. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  10. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  11. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  12. ---
  13. grub-core/video/fb/video_fb.c | 8 +++++++-
  14. 1 file changed, 7 insertions(+), 1 deletion(-)
  15. diff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c
  16. index 1c9a138..ae6b89f 100644
  17. --- a/grub-core/video/fb/video_fb.c
  18. +++ b/grub-core/video/fb/video_fb.c
  19. @@ -1537,7 +1537,13 @@ doublebuf_pageflipping_init (struct grub_video_mode_info *mode_info,
  20. volatile void *page1_ptr)
  21. {
  22. grub_err_t err;
  23. - grub_size_t page_size = mode_info->pitch * mode_info->height;
  24. + grub_size_t page_size = 0;
  25. +
  26. + if (grub_mul (mode_info->pitch, mode_info->height, &page_size))
  27. + {
  28. + /* Shouldn't happen, but if it does we've a bug. */
  29. + return GRUB_ERR_BUG;
  30. + }
  31. framebuffer.offscreen_buffer = grub_malloc (page_size);
  32. if (! framebuffer.offscreen_buffer)
  33. --
  34. 2.14.2