0080-video-fb-fbfill-Fix-potential-integer-overflow.patch 3.2 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879
  1. From 7ce3259f67ac2cd93acb0ec0080c24b3b69e66c6 Mon Sep 17 00:00:00 2001
  2. From: Darren Kenny <darren.kenny@oracle.com>
  3. Date: Wed, 4 Nov 2020 15:10:51 +0000
  4. Subject: [PATCH] video/fb/fbfill: Fix potential integer overflow
  5. The multiplication of 2 unsigned 32-bit integers may overflow before
  6. promotion to unsigned 64-bit. We should ensure that the multiplication
  7. is done with overflow detection. Additionally, use grub_sub() for
  8. subtraction.
  9. Fixes: CID 73640, CID 73697, CID 73702, CID 73823
  10. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  11. Signed-off-by: Marco A Benatto <mbenatto@redhat.com>
  12. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  13. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  14. ---
  15. grub-core/video/fb/fbfill.c | 17 +++++++++++++----
  16. 1 file changed, 13 insertions(+), 4 deletions(-)
  17. diff --git a/grub-core/video/fb/fbfill.c b/grub-core/video/fb/fbfill.c
  18. index 11816d0..a37acd1 100644
  19. --- a/grub-core/video/fb/fbfill.c
  20. +++ b/grub-core/video/fb/fbfill.c
  21. @@ -31,6 +31,7 @@
  22. #include <grub/fbfill.h>
  23. #include <grub/fbutil.h>
  24. #include <grub/types.h>
  25. +#include <grub/safemath.h>
  26. #include <grub/video.h>
  27. /* Generic filler that works for every supported mode. */
  28. @@ -61,7 +62,9 @@ grub_video_fbfill_direct32 (struct grub_video_fbblit_info *dst,
  29. /* Calculate the number of bytes to advance from the end of one line
  30. to the beginning of the next line. */
  31. - rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width;
  32. + if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) ||
  33. + grub_sub (dst->mode_info->pitch, rowskip, &rowskip))
  34. + return;
  35. /* Get the start address. */
  36. dstptr = grub_video_fb_get_video_ptr (dst, x, y);
  37. @@ -98,7 +101,9 @@ grub_video_fbfill_direct24 (struct grub_video_fbblit_info *dst,
  38. #endif
  39. /* Calculate the number of bytes to advance from the end of one line
  40. to the beginning of the next line. */
  41. - rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width;
  42. + if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) ||
  43. + grub_sub (dst->mode_info->pitch, rowskip, &rowskip))
  44. + return;
  45. /* Get the start address. */
  46. dstptr = grub_video_fb_get_video_ptr (dst, x, y);
  47. @@ -131,7 +136,9 @@ grub_video_fbfill_direct16 (struct grub_video_fbblit_info *dst,
  48. /* Calculate the number of bytes to advance from the end of one line
  49. to the beginning of the next line. */
  50. - rowskip = (dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width);
  51. + if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) ||
  52. + grub_sub (dst->mode_info->pitch, rowskip, &rowskip))
  53. + return;
  54. /* Get the start address. */
  55. dstptr = grub_video_fb_get_video_ptr (dst, x, y);
  56. @@ -161,7 +168,9 @@ grub_video_fbfill_direct8 (struct grub_video_fbblit_info *dst,
  57. /* Calculate the number of bytes to advance from the end of one line
  58. to the beginning of the next line. */
  59. - rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width;
  60. + if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) ||
  61. + grub_sub (dst->mode_info->pitch, rowskip, &rowskip))
  62. + return;
  63. /* Get the start address. */
  64. dstptr = grub_video_fb_get_video_ptr (dst, x, y);
  65. --
  66. 2.14.2