0097-commands-menuentry-Fix-quoting-in-setparams_prefix.patch 1.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748
  1. From 2f533a89a8dfcacbf2c9dbc77d910f111f24bf33 Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Fri, 22 Jan 2021 17:10:48 +1100
  4. Subject: [PATCH] commands/menuentry: Fix quoting in setparams_prefix()
  5. Commit 9acdcbf32542 (use single quotes in menuentry setparams command)
  6. says that expressing a quoted single quote will require 3 characters. It
  7. actually requires (and always did require!) 4 characters:
  8. str: a'b => a'\''b
  9. len: 3 => 6 (2 for the letters + 4 for the quote)
  10. This leads to not allocating enough memory and thus out of bounds writes
  11. that have been observed to cause heap corruption.
  12. Allocate 4 bytes for each single quote.
  13. Commit 22e7dbb2bb81 (Fix quoting in legacy parser.) does the same
  14. quoting, but it adds 3 as extra overhead on top of the single byte that
  15. the quote already needs. So it's correct.
  16. Fixes: 9acdcbf32542 (use single quotes in menuentry setparams command)
  17. Fixes: CVE-2021-20233
  18. Reported-by: Daniel Axtens <dja@axtens.net>
  19. Signed-off-by: Daniel Axtens <dja@axtens.net>
  20. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  21. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  22. ---
  23. grub-core/commands/menuentry.c | 2 +-
  24. 1 file changed, 1 insertion(+), 1 deletion(-)
  25. diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
  26. index 9164df7..720e6d8 100644
  27. --- a/grub-core/commands/menuentry.c
  28. +++ b/grub-core/commands/menuentry.c
  29. @@ -230,7 +230,7 @@ setparams_prefix (int argc, char **args)
  30. len += 3; /* 3 = 1 space + 2 quotes */
  31. p = args[i];
  32. while (*p)
  33. - len += (*p++ == '\'' ? 3 : 1);
  34. + len += (*p++ == '\'' ? 4 : 1);
  35. }
  36. result = grub_malloc (len + 2);
  37. --
  38. 2.14.2