123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105 |
- From 08e098b1dbf01e96376f594b337491bc4cfa48dd Mon Sep 17 00:00:00 2001
- From: Darren Kenny <darren.kenny@oracle.com>
- Date: Wed, 4 Nov 2020 14:43:44 +0000
- Subject: [PATCH] video/fb/video_fb: Fix multiple integer overflows
- The calculation of the unsigned 64-bit value is being generated by
- multiplying 2, signed or unsigned, 32-bit integers which may overflow
- before promotion to unsigned 64-bit. Fix all of them.
- Fixes: CID 73703, CID 73767, CID 73833
- Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
- Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
- Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
- ---
- grub-core/video/fb/video_fb.c | 52 ++++++++++++++++++++++++++++++-------------
- 1 file changed, 36 insertions(+), 16 deletions(-)
- diff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c
- index 1a602c8..1c9a138 100644
- --- a/grub-core/video/fb/video_fb.c
- +++ b/grub-core/video/fb/video_fb.c
- @@ -25,6 +25,7 @@
- #include <grub/fbutil.h>
- #include <grub/bitmap.h>
- #include <grub/dl.h>
- +#include <grub/safemath.h>
-
- GRUB_MOD_LICENSE ("GPLv3+");
-
- @@ -1417,15 +1418,23 @@ doublebuf_blit_update_screen (void)
- {
- if (framebuffer.current_dirty.first_line
- <= framebuffer.current_dirty.last_line)
- - grub_memcpy ((char *) framebuffer.pages[0]
- - + framebuffer.current_dirty.first_line
- - * framebuffer.back_target->mode_info.pitch,
- - (char *) framebuffer.back_target->data
- - + framebuffer.current_dirty.first_line
- - * framebuffer.back_target->mode_info.pitch,
- - framebuffer.back_target->mode_info.pitch
- - * (framebuffer.current_dirty.last_line
- - - framebuffer.current_dirty.first_line));
- + {
- + grub_size_t copy_size;
- +
- + if (grub_sub (framebuffer.current_dirty.last_line,
- + framebuffer.current_dirty.first_line, ©_size) ||
- + grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, ©_size))
- + {
- + /* Shouldn't happen, but if it does we've a bug. */
- + return GRUB_ERR_BUG;
- + }
- +
- + grub_memcpy ((char *) framebuffer.pages[0] + framebuffer.current_dirty.first_line *
- + framebuffer.back_target->mode_info.pitch,
- + (char *) framebuffer.back_target->data + framebuffer.current_dirty.first_line *
- + framebuffer.back_target->mode_info.pitch,
- + copy_size);
- + }
- framebuffer.current_dirty.first_line
- = framebuffer.back_target->mode_info.height;
- framebuffer.current_dirty.last_line = 0;
- @@ -1439,7 +1448,7 @@ grub_video_fb_doublebuf_blit_init (struct grub_video_fbrender_target **back,
- volatile void *framebuf)
- {
- grub_err_t err;
- - grub_size_t page_size = mode_info.pitch * mode_info.height;
- + grub_size_t page_size = (grub_size_t) mode_info.pitch * mode_info.height;
-
- framebuffer.offscreen_buffer = grub_zalloc (page_size);
- if (! framebuffer.offscreen_buffer)
- @@ -1482,12 +1491,23 @@ doublebuf_pageflipping_update_screen (void)
- last_line = framebuffer.previous_dirty.last_line;
-
- if (first_line <= last_line)
- - grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page]
- - + first_line * framebuffer.back_target->mode_info.pitch,
- - (char *) framebuffer.back_target->data
- - + first_line * framebuffer.back_target->mode_info.pitch,
- - framebuffer.back_target->mode_info.pitch
- - * (last_line - first_line));
- + {
- + grub_size_t copy_size;
- +
- + if (grub_sub (last_line, first_line, ©_size) ||
- + grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, ©_size))
- + {
- + /* Shouldn't happen, but if it does we've a bug. */
- + return GRUB_ERR_BUG;
- + }
- +
- + grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page] + first_line *
- + framebuffer.back_target->mode_info.pitch,
- + (char *) framebuffer.back_target->data + first_line *
- + framebuffer.back_target->mode_info.pitch,
- + copy_size);
- + }
- +
- framebuffer.previous_dirty = framebuffer.current_dirty;
- framebuffer.current_dirty.first_line
- = framebuffer.back_target->mode_info.height;
- --
- 2.14.2
|