0095-lib-arg-Block-repeated-short-options-that-require-an.patch 1.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556
  1. From 2a330dba93ff11bc00eda76e9419bc52b0c7ead6 Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Fri, 22 Jan 2021 16:07:29 +1100
  4. Subject: [PATCH] lib/arg: Block repeated short options that require an
  5. argument
  6. Fuzzing found the following crash:
  7. search -hhhhhhhhhhhhhf
  8. We didn't allocate enough option space for 13 hints because the
  9. allocation code counts the number of discrete arguments (i.e. argc).
  10. However, the shortopt parsing code will happily keep processing
  11. a combination of short options without checking if those short
  12. options require an argument. This means you can easily end writing
  13. past the allocated option space.
  14. This fixes a OOB write which can cause heap corruption.
  15. Fixes: CVE-2021-20225
  16. Reported-by: Daniel Axtens <dja@axtens.net>
  17. Signed-off-by: Daniel Axtens <dja@axtens.net>
  18. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  19. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  20. ---
  21. grub-core/lib/arg.c | 13 +++++++++++++
  22. 1 file changed, 13 insertions(+)
  23. diff --git a/grub-core/lib/arg.c b/grub-core/lib/arg.c
  24. index 3288609..537c5e9 100644
  25. --- a/grub-core/lib/arg.c
  26. +++ b/grub-core/lib/arg.c
  27. @@ -299,6 +299,19 @@ grub_arg_parse (grub_extcmd_t cmd, int argc, char **argv,
  28. it can have an argument value. */
  29. if (*curshort)
  30. {
  31. + /*
  32. + * Only permit further short opts if this one doesn't
  33. + * require a value.
  34. + */
  35. + if (opt->type != ARG_TYPE_NONE &&
  36. + !(opt->flags & GRUB_ARG_OPTION_OPTIONAL))
  37. + {
  38. + grub_error (GRUB_ERR_BAD_ARGUMENT,
  39. + N_("missing mandatory option for `%s'"),
  40. + opt->longarg);
  41. + goto fail;
  42. + }
  43. +
  44. if (parse_option (cmd, opt, 0, usr) || grub_errno)
  45. goto fail;
  46. }
  47. --
  48. 2.14.2