0081-video-fb-video_fb-Fix-multiple-integer-overflows.patch 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. From 08e098b1dbf01e96376f594b337491bc4cfa48dd Mon Sep 17 00:00:00 2001
  2. From: Darren Kenny <darren.kenny@oracle.com>
  3. Date: Wed, 4 Nov 2020 14:43:44 +0000
  4. Subject: [PATCH] video/fb/video_fb: Fix multiple integer overflows
  5. The calculation of the unsigned 64-bit value is being generated by
  6. multiplying 2, signed or unsigned, 32-bit integers which may overflow
  7. before promotion to unsigned 64-bit. Fix all of them.
  8. Fixes: CID 73703, CID 73767, CID 73833
  9. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  10. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  11. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  12. ---
  13. grub-core/video/fb/video_fb.c | 52 ++++++++++++++++++++++++++++++-------------
  14. 1 file changed, 36 insertions(+), 16 deletions(-)
  15. diff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c
  16. index 1a602c8..1c9a138 100644
  17. --- a/grub-core/video/fb/video_fb.c
  18. +++ b/grub-core/video/fb/video_fb.c
  19. @@ -25,6 +25,7 @@
  20. #include <grub/fbutil.h>
  21. #include <grub/bitmap.h>
  22. #include <grub/dl.h>
  23. +#include <grub/safemath.h>
  24. GRUB_MOD_LICENSE ("GPLv3+");
  25. @@ -1417,15 +1418,23 @@ doublebuf_blit_update_screen (void)
  26. {
  27. if (framebuffer.current_dirty.first_line
  28. <= framebuffer.current_dirty.last_line)
  29. - grub_memcpy ((char *) framebuffer.pages[0]
  30. - + framebuffer.current_dirty.first_line
  31. - * framebuffer.back_target->mode_info.pitch,
  32. - (char *) framebuffer.back_target->data
  33. - + framebuffer.current_dirty.first_line
  34. - * framebuffer.back_target->mode_info.pitch,
  35. - framebuffer.back_target->mode_info.pitch
  36. - * (framebuffer.current_dirty.last_line
  37. - - framebuffer.current_dirty.first_line));
  38. + {
  39. + grub_size_t copy_size;
  40. +
  41. + if (grub_sub (framebuffer.current_dirty.last_line,
  42. + framebuffer.current_dirty.first_line, &copy_size) ||
  43. + grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, &copy_size))
  44. + {
  45. + /* Shouldn't happen, but if it does we've a bug. */
  46. + return GRUB_ERR_BUG;
  47. + }
  48. +
  49. + grub_memcpy ((char *) framebuffer.pages[0] + framebuffer.current_dirty.first_line *
  50. + framebuffer.back_target->mode_info.pitch,
  51. + (char *) framebuffer.back_target->data + framebuffer.current_dirty.first_line *
  52. + framebuffer.back_target->mode_info.pitch,
  53. + copy_size);
  54. + }
  55. framebuffer.current_dirty.first_line
  56. = framebuffer.back_target->mode_info.height;
  57. framebuffer.current_dirty.last_line = 0;
  58. @@ -1439,7 +1448,7 @@ grub_video_fb_doublebuf_blit_init (struct grub_video_fbrender_target **back,
  59. volatile void *framebuf)
  60. {
  61. grub_err_t err;
  62. - grub_size_t page_size = mode_info.pitch * mode_info.height;
  63. + grub_size_t page_size = (grub_size_t) mode_info.pitch * mode_info.height;
  64. framebuffer.offscreen_buffer = grub_zalloc (page_size);
  65. if (! framebuffer.offscreen_buffer)
  66. @@ -1482,12 +1491,23 @@ doublebuf_pageflipping_update_screen (void)
  67. last_line = framebuffer.previous_dirty.last_line;
  68. if (first_line <= last_line)
  69. - grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page]
  70. - + first_line * framebuffer.back_target->mode_info.pitch,
  71. - (char *) framebuffer.back_target->data
  72. - + first_line * framebuffer.back_target->mode_info.pitch,
  73. - framebuffer.back_target->mode_info.pitch
  74. - * (last_line - first_line));
  75. + {
  76. + grub_size_t copy_size;
  77. +
  78. + if (grub_sub (last_line, first_line, &copy_size) ||
  79. + grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, &copy_size))
  80. + {
  81. + /* Shouldn't happen, but if it does we've a bug. */
  82. + return GRUB_ERR_BUG;
  83. + }
  84. +
  85. + grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page] + first_line *
  86. + framebuffer.back_target->mode_info.pitch,
  87. + (char *) framebuffer.back_target->data + first_line *
  88. + framebuffer.back_target->mode_info.pitch,
  89. + copy_size);
  90. + }
  91. +
  92. framebuffer.previous_dirty = framebuffer.current_dirty;
  93. framebuffer.current_dirty.first_line
  94. = framebuffer.back_target->mode_info.height;
  95. --
  96. 2.14.2