0008-font-Do-not-load-more-than-one-NAME-section.patch 1.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041
  1. From 73bc7a964c9496d5b0f00dbd69959dacf5adcebe Mon Sep 17 00:00:00 2001
  2. From: Daniel Kiper <daniel.kiper@oracle.com>
  3. Date: Tue, 7 Jul 2020 15:36:26 +0200
  4. Subject: [PATCH] font: Do not load more than one NAME section
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. The GRUB font file can have one NAME section only. Though if somebody
  9. crafts a broken font file with many NAME sections and loads it then the
  10. GRUB leaks memory. So, prevent against that by loading first NAME
  11. section and failing in controlled way on following one.
  12. Reported-by: Chris Coulson <chris.coulson@canonical.com>
  13. Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
  14. Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
  15. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  16. ---
  17. grub-core/font/font.c | 6 ++++++
  18. 1 file changed, 6 insertions(+)
  19. diff --git a/grub-core/font/font.c b/grub-core/font/font.c
  20. index 5edb477ac..d09bb38d8 100644
  21. --- a/grub-core/font/font.c
  22. +++ b/grub-core/font/font.c
  23. @@ -532,6 +532,12 @@ grub_font_load (const char *filename)
  24. if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME,
  25. sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0)
  26. {
  27. + if (font->name != NULL)
  28. + {
  29. + grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections");
  30. + goto fail;
  31. + }
  32. +
  33. font->name = read_section_as_string (&section);
  34. if (!font->name)
  35. goto fail;
  36. --
  37. 2.26.2