dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0287-font-Do-not-load-more-than-one-NAME-section.patch

c294fc
From 0b3c4b90e1b928a2606f0801e6e872dd6cb85c42 Mon Sep 17 00:00:00 2001
c294fc
From: Daniel Kiper <daniel.kiper@oracle.com>
c294fc
Date: Tue, 7 Jul 2020 15:36:26 +0200
c294fc
Subject: [PATCH 287/314] font: Do not load more than one NAME section
c294fc
c294fc
The GRUB font file can have one NAME section only. Though if somebody
c294fc
crafts a broken font file with many NAME sections and loads it then the
c294fc
GRUB leaks memory. So, prevent against that by loading first NAME
c294fc
section and failing in controlled way on following one.
c294fc
c294fc
Reported-by: Chris Coulson <chris.coulson@canonical.com>
c294fc
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
c294fc
Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
c294fc
Upstream-commit-id: 482814113dc
c294fc
---
c294fc
 grub-core/font/font.c | 6 ++++++
c294fc
 1 file changed, 6 insertions(+)
c294fc
c294fc
diff --git a/grub-core/font/font.c b/grub-core/font/font.c
c294fc
index d63354fb51b..a7b955a1a74 100644
c294fc
--- a/grub-core/font/font.c
c294fc
+++ b/grub-core/font/font.c
c294fc
@@ -532,6 +532,12 @@ grub_font_load (const char *filename)
c294fc
       if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME,
c294fc
 		       sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0)
c294fc
 	{
c294fc
+	  if (font->name != NULL)
c294fc
+	    {
c294fc
+	      grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections");
c294fc
+	      goto fail;
c294fc
+	    }
c294fc
+
c294fc
 	  font->name = read_section_as_string (&section);
c294fc
 	  if (!font->name)
c294fc
 	    goto fail;
c294fc
-- 
c294fc
2.26.2
c294fc