12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849 |
- From a8cc95de74ccc3ad090e8062ac335c844f13c9f4 Mon Sep 17 00:00:00 2001
- From: Daniel Axtens <dja@axtens.net>
- Date: Thu, 21 Jan 2021 17:59:14 +1100
- Subject: [PATCH] disk/lvm: Don't go beyond the end of the data we read from
- disk
- We unconditionally trusted offset_xl from the LVM label header, even if
- it told us that the PV header/disk locations were way off past the end
- of the data we read from disk.
- Require that the offset be sane, fixing an OOB read and crash.
- Fixes: CID 314367, CID 314371
- Signed-off-by: Daniel Axtens <dja@axtens.net>
- Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
- Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
- ---
- grub-core/disk/lvm.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
- diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
- index 139fafd..8136122 100644
- --- a/grub-core/disk/lvm.c
- +++ b/grub-core/disk/lvm.c
- @@ -141,6 +141,20 @@ grub_lvm_detect (grub_disk_t disk,
- goto fail;
- }
-
- + /*
- + * We read a grub_lvm_pv_header and then 2 grub_lvm_disk_locns that
- + * immediately follow the PV header. Make sure we have space for both.
- + */
- + if (grub_le_to_cpu32 (lh->offset_xl) >=
- + GRUB_LVM_LABEL_SIZE - sizeof (struct grub_lvm_pv_header) -
- + 2 * sizeof (struct grub_lvm_disk_locn))
- + {
- +#ifdef GRUB_UTIL
- + grub_util_info ("LVM PV header/disk locations are beyond the end of the block");
- +#endif
- + goto fail;
- + }
- +
- pvh = (struct grub_lvm_pv_header *) (buf + grub_le_to_cpu32(lh->offset_xl));
-
- for (i = 0, j = 0; i < GRUB_LVM_ID_LEN; i++)
- --
- 2.14.2
|