dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0334-linux-Fix-integer-overflows-in-initrd-size-handling.patch

c4e390
From ea5144a3ca0b58e785dd9729e6c2d6a81e18870c Mon Sep 17 00:00:00 2001
c4e390
From: Colin Watson <cjwatson@debian.org>
c4e390
Date: Sat, 25 Jul 2020 12:15:37 +0100
c4e390
Subject: [PATCH 334/336] linux: Fix integer overflows in initrd size handling
c4e390
c4e390
These could be triggered by a crafted filesystem with very large files.
c4e390
c4e390
Fixes: CVE-2020-15707
c4e390
c4e390
Signed-off-by: Colin Watson <cjwatson@debian.org>
c4e390
Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
c4e390
---
c4e390
 grub-core/loader/linux.c | 74 +++++++++++++++++++++++++++++-----------
c4e390
 1 file changed, 54 insertions(+), 20 deletions(-)
c4e390
c4e390
diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c
c4e390
index 2305281df04..951f7556fb4 100644
c4e390
--- a/grub-core/loader/linux.c
c4e390
+++ b/grub-core/loader/linux.c
c4e390
@@ -4,6 +4,7 @@
c4e390
 #include <grub/misc.h>
c4e390
 #include <grub/file.h>
c4e390
 #include <grub/mm.h>
c4e390
+#include <grub/safemath.h>
c4e390
 
c4e390
 struct newc_head
c4e390
 {
c4e390
@@ -98,13 +99,13 @@ free_dir (struct dir *root)
c4e390
   grub_free (root);
c4e390
 }
c4e390
 
c4e390
-static grub_size_t
c4e390
+static grub_err_t
c4e390
 insert_dir (const char *name, struct dir **root,
c4e390
-	    grub_uint8_t *ptr)
c4e390
+	    grub_uint8_t *ptr, grub_size_t *size)
c4e390
 {
c4e390
   struct dir *cur, **head = root;
c4e390
   const char *cb, *ce = name;
c4e390
-  grub_size_t size = 0;
c4e390
+  *size = 0;
c4e390
   while (1)
c4e390
     {
c4e390
       for (cb = ce; *cb == '/'; cb++);
c4e390
@@ -130,14 +131,22 @@ insert_dir (const char *name, struct dir **root,
c4e390
 	      ptr = make_header (ptr, name, ce - name,
c4e390
 				 040777, 0);
c4e390
 	    }
c4e390
-	  size += ALIGN_UP ((ce - (char *) name)
c4e390
-			    + sizeof (struct newc_head), 4);
c4e390
+	  if (grub_add (*size,
c4e390
+		        ALIGN_UP ((ce - (char *) name)
c4e390
+				  + sizeof (struct newc_head), 4),
c4e390
+			size))
c4e390
+	    {
c4e390
+	      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
c4e390
+	      grub_free (n->name);
c4e390
+	      grub_free (n);
c4e390
+	      return grub_errno;
c4e390
+	    }
c4e390
 	  *head = n;
c4e390
 	  cur = n;
c4e390
 	}
c4e390
       root = &cur->next;
c4e390
     }
c4e390
-  return size;
c4e390
+  return GRUB_ERR_NONE;
c4e390
 }
c4e390
 
c4e390
 grub_err_t
c4e390
@@ -174,26 +183,33 @@ grub_initrd_init (int argc, char *argv[],
c4e390
 	  if (eptr)
c4e390
 	    {
c4e390
 	      grub_file_filter_disable_compression ();
c4e390
+	      grub_size_t dir_size, name_len;
c4e390
+
c4e390
 	      initrd_ctx->components[i].newc_name = grub_strndup (ptr, eptr - ptr);
c4e390
-	      if (!initrd_ctx->components[i].newc_name)
c4e390
+	      if (!initrd_ctx->components[i].newc_name ||
c4e390
+		  insert_dir (initrd_ctx->components[i].newc_name, &root, 0,
c4e390
+			      &dir_size))
c4e390
 		{
c4e390
 		  grub_initrd_close (initrd_ctx);
c4e390
 		  return grub_errno;
c4e390
 		}
c4e390
-	      initrd_ctx->size
c4e390
-		+= ALIGN_UP (sizeof (struct newc_head)
c4e390
-			    + grub_strlen (initrd_ctx->components[i].newc_name),
c4e390
-			     4);
c4e390
-	      initrd_ctx->size += insert_dir (initrd_ctx->components[i].newc_name,
c4e390
-					      &root, 0);
c4e390
+	      name_len = grub_strlen (initrd_ctx->components[i].newc_name);
c4e390
+	      if (grub_add (initrd_ctx->size,
c4e390
+			    ALIGN_UP (sizeof (struct newc_head) + name_len, 4),
c4e390
+			    &initrd_ctx->size) ||
c4e390
+		  grub_add (initrd_ctx->size, dir_size, &initrd_ctx->size))
c4e390
+		goto overflow;
c4e390
 	      newc = 1;
c4e390
 	      fname = eptr + 1;
c4e390
 	    }
c4e390
 	}
c4e390
       else if (newc)
c4e390
 	{
c4e390
-	  initrd_ctx->size += ALIGN_UP (sizeof (struct newc_head)
c4e390
-					+ sizeof ("TRAILER!!!") - 1, 4);
c4e390
+	  if (grub_add (initrd_ctx->size,
c4e390
+			ALIGN_UP (sizeof (struct newc_head)
c4e390
+				  + sizeof ("TRAILER!!!") - 1, 4),
c4e390
+			&initrd_ctx->size))
c4e390
+	    goto overflow;
c4e390
 	  free_dir (root);
c4e390
 	  root = 0;
c4e390
 	  newc = 0;
c4e390
@@ -208,19 +224,29 @@ grub_initrd_init (int argc, char *argv[],
c4e390
       initrd_ctx->nfiles++;
c4e390
       initrd_ctx->components[i].size
c4e390
 	= grub_file_size (initrd_ctx->components[i].file);
c4e390
-      initrd_ctx->size += initrd_ctx->components[i].size;
c4e390
+      if (grub_add (initrd_ctx->size, initrd_ctx->components[i].size,
c4e390
+		    &initrd_ctx->size))
c4e390
+	goto overflow;
c4e390
     }
c4e390
 
c4e390
   if (newc)
c4e390
     {
c4e390
       initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4);
c4e390
-      initrd_ctx->size += ALIGN_UP (sizeof (struct newc_head)
c4e390
-				    + sizeof ("TRAILER!!!") - 1, 4);
c4e390
+      if (grub_add (initrd_ctx->size,
c4e390
+		    ALIGN_UP (sizeof (struct newc_head)
c4e390
+			      + sizeof ("TRAILER!!!") - 1, 4),
c4e390
+		    &initrd_ctx->size))
c4e390
+	goto overflow;
c4e390
       free_dir (root);
c4e390
       root = 0;
c4e390
     }
c4e390
   
c4e390
   return GRUB_ERR_NONE;
c4e390
+
c4e390
+overflow:
c4e390
+  free_dir (root);
c4e390
+  grub_initrd_close (initrd_ctx);
c4e390
+  return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
c4e390
 }
c4e390
 
c4e390
 grub_size_t
c4e390
@@ -261,8 +287,16 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx,
c4e390
 
c4e390
       if (initrd_ctx->components[i].newc_name)
c4e390
 	{
c4e390
-	  ptr += insert_dir (initrd_ctx->components[i].newc_name,
c4e390
-			     &root, ptr);
c4e390
+	  grub_size_t dir_size;
c4e390
+
c4e390
+	  if (insert_dir (initrd_ctx->components[i].newc_name, &root, ptr,
c4e390
+			  &dir_size))
c4e390
+	    {
c4e390
+	      free_dir (root);
c4e390
+	      grub_initrd_close (initrd_ctx);
c4e390
+	      return grub_errno;
c4e390
+	    }
c4e390
+	  ptr += dir_size;
c4e390
 	  ptr = make_header (ptr, initrd_ctx->components[i].newc_name,
c4e390
 			     grub_strlen (initrd_ctx->components[i].newc_name),
c4e390
 			     0100777,
c4e390
-- 
c4e390
2.26.2
c4e390