0118-disk-lvm-Don-t-go-beyond-the-end-of-the-data-we-read.patch 1.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849
  1. From a8cc95de74ccc3ad090e8062ac335c844f13c9f4 Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Thu, 21 Jan 2021 17:59:14 +1100
  4. Subject: [PATCH] disk/lvm: Don't go beyond the end of the data we read from
  5. disk
  6. We unconditionally trusted offset_xl from the LVM label header, even if
  7. it told us that the PV header/disk locations were way off past the end
  8. of the data we read from disk.
  9. Require that the offset be sane, fixing an OOB read and crash.
  10. Fixes: CID 314367, CID 314371
  11. Signed-off-by: Daniel Axtens <dja@axtens.net>
  12. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  13. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  14. ---
  15. grub-core/disk/lvm.c | 14 ++++++++++++++
  16. 1 file changed, 14 insertions(+)
  17. diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
  18. index 139fafd..8136122 100644
  19. --- a/grub-core/disk/lvm.c
  20. +++ b/grub-core/disk/lvm.c
  21. @@ -141,6 +141,20 @@ grub_lvm_detect (grub_disk_t disk,
  22. goto fail;
  23. }
  24. + /*
  25. + * We read a grub_lvm_pv_header and then 2 grub_lvm_disk_locns that
  26. + * immediately follow the PV header. Make sure we have space for both.
  27. + */
  28. + if (grub_le_to_cpu32 (lh->offset_xl) >=
  29. + GRUB_LVM_LABEL_SIZE - sizeof (struct grub_lvm_pv_header) -
  30. + 2 * sizeof (struct grub_lvm_disk_locn))
  31. + {
  32. +#ifdef GRUB_UTIL
  33. + grub_util_info ("LVM PV header/disk locations are beyond the end of the block");
  34. +#endif
  35. + goto fail;
  36. + }
  37. +
  38. pvh = (struct grub_lvm_pv_header *) (buf + grub_le_to_cpu32(lh->offset_xl));
  39. for (i = 0, j = 0; i < GRUB_LVM_ID_LEN; i++)
  40. --
  41. 2.14.2