dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0380-video-fb-video_fb-Fix-multiple-integer-overflows.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Darren Kenny <darren.kenny@oracle.com>
b1bcb2
Date: Wed, 4 Nov 2020 14:43:44 +0000
b1bcb2
Subject: [PATCH] video/fb/video_fb: Fix multiple integer overflows
b1bcb2
b1bcb2
The calculation of the unsigned 64-bit value is being generated by
b1bcb2
multiplying 2, signed or unsigned, 32-bit integers which may overflow
b1bcb2
before promotion to unsigned 64-bit. Fix all of them.
b1bcb2
b1bcb2
Fixes: CID 73703, CID 73767, CID 73833
b1bcb2
b1bcb2
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/video/fb/video_fb.c | 52 ++++++++++++++++++++++++++++++-------------
b1bcb2
 1 file changed, 36 insertions(+), 16 deletions(-)
b1bcb2
b1bcb2
diff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c
b1bcb2
index 722bb3bb436..eae87bab1ea 100644
b1bcb2
--- a/grub-core/video/fb/video_fb.c
b1bcb2
+++ b/grub-core/video/fb/video_fb.c
b1bcb2
@@ -25,6 +25,7 @@
b1bcb2
 #include <grub/fbutil.h>
b1bcb2
 #include <grub/bitmap.h>
b1bcb2
 #include <grub/dl.h>
b1bcb2
+#include <grub/safemath.h>
b1bcb2
 
b1bcb2
 GRUB_MOD_LICENSE ("GPLv3+");
b1bcb2
 
b1bcb2
@@ -1417,15 +1418,23 @@ doublebuf_blit_update_screen (void)
b1bcb2
 {
b1bcb2
   if (framebuffer.current_dirty.first_line
b1bcb2
       <= framebuffer.current_dirty.last_line)
b1bcb2
-    grub_memcpy ((char *) framebuffer.pages[0]
b1bcb2
-		 + framebuffer.current_dirty.first_line
b1bcb2
-		 * framebuffer.back_target->mode_info.pitch,
b1bcb2
-		 (char *) framebuffer.back_target->data
b1bcb2
-		 + framebuffer.current_dirty.first_line
b1bcb2
-		 * framebuffer.back_target->mode_info.pitch,
b1bcb2
-		 framebuffer.back_target->mode_info.pitch
b1bcb2
-		 * (framebuffer.current_dirty.last_line
b1bcb2
-		    - framebuffer.current_dirty.first_line));
b1bcb2
+    {
b1bcb2
+      grub_size_t copy_size;
b1bcb2
+
b1bcb2
+      if (grub_sub (framebuffer.current_dirty.last_line,
b1bcb2
+		    framebuffer.current_dirty.first_line, &copy_size) ||
b1bcb2
+	  grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, &copy_size))
b1bcb2
+	{
b1bcb2
+	  /* Shouldn't happen, but if it does we've a bug. */
b1bcb2
+	  return GRUB_ERR_BUG;
b1bcb2
+	}
b1bcb2
+
b1bcb2
+      grub_memcpy ((char *) framebuffer.pages[0] + framebuffer.current_dirty.first_line *
b1bcb2
+		   framebuffer.back_target->mode_info.pitch,
b1bcb2
+		   (char *) framebuffer.back_target->data + framebuffer.current_dirty.first_line *
b1bcb2
+		   framebuffer.back_target->mode_info.pitch,
b1bcb2
+		   copy_size);
b1bcb2
+    }
b1bcb2
   framebuffer.current_dirty.first_line
b1bcb2
     = framebuffer.back_target->mode_info.height;
b1bcb2
   framebuffer.current_dirty.last_line = 0;
b1bcb2
@@ -1439,7 +1448,7 @@ grub_video_fb_doublebuf_blit_init (struct grub_video_fbrender_target **back,
b1bcb2
 				   volatile void *framebuf)
b1bcb2
 {
b1bcb2
   grub_err_t err;
b1bcb2
-  grub_size_t page_size = mode_info.pitch * mode_info.height;
b1bcb2
+  grub_size_t page_size = (grub_size_t) mode_info.pitch * mode_info.height;
b1bcb2
 
b1bcb2
   framebuffer.offscreen_buffer = grub_zalloc (page_size);
b1bcb2
   if (! framebuffer.offscreen_buffer)
b1bcb2
@@ -1482,12 +1491,23 @@ doublebuf_pageflipping_update_screen (void)
b1bcb2
     last_line = framebuffer.previous_dirty.last_line;
b1bcb2
 
b1bcb2
   if (first_line <= last_line)
b1bcb2
-    grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page]
b1bcb2
-		 + first_line * framebuffer.back_target->mode_info.pitch,
b1bcb2
-		 (char *) framebuffer.back_target->data
b1bcb2
-		 + first_line * framebuffer.back_target->mode_info.pitch,
b1bcb2
-		 framebuffer.back_target->mode_info.pitch
b1bcb2
-		 * (last_line - first_line));
b1bcb2
+    {
b1bcb2
+      grub_size_t copy_size;
b1bcb2
+
b1bcb2
+      if (grub_sub (last_line, first_line, &copy_size) ||
b1bcb2
+	  grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, &copy_size))
b1bcb2
+	{
b1bcb2
+	  /* Shouldn't happen, but if it does we've a bug. */
b1bcb2
+	  return GRUB_ERR_BUG;
b1bcb2
+	}
b1bcb2
+
b1bcb2
+      grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page] + first_line *
b1bcb2
+		   framebuffer.back_target->mode_info.pitch,
b1bcb2
+		   (char *) framebuffer.back_target->data + first_line *
b1bcb2
+		   framebuffer.back_target->mode_info.pitch,
b1bcb2
+		   copy_size);
b1bcb2
+    }
b1bcb2
+
b1bcb2
   framebuffer.previous_dirty = framebuffer.current_dirty;
b1bcb2
   framebuffer.current_dirty.first_line
b1bcb2
     = framebuffer.back_target->mode_info.height;