dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0381-video-fb-video_fb-Fix-possible-integer-overflow.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Darren Kenny <darren.kenny@oracle.com>
b1bcb2
Date: Fri, 4 Dec 2020 14:51:30 +0000
b1bcb2
Subject: [PATCH] video/fb/video_fb: Fix possible integer overflow
b1bcb2
b1bcb2
It is minimal possibility that the values being used here will overflow.
b1bcb2
So, change the code to use the safemath function grub_mul() to ensure
b1bcb2
that doesn't happen.
b1bcb2
b1bcb2
Fixes: CID 73761
b1bcb2
b1bcb2
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/video/fb/video_fb.c | 8 +++++++-
b1bcb2
 1 file changed, 7 insertions(+), 1 deletion(-)
b1bcb2
b1bcb2
diff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c
b1bcb2
index eae87bab1ea..33cf98f655b 100644
b1bcb2
--- a/grub-core/video/fb/video_fb.c
b1bcb2
+++ b/grub-core/video/fb/video_fb.c
b1bcb2
@@ -1537,7 +1537,13 @@ doublebuf_pageflipping_init (struct grub_video_mode_info *mode_info,
b1bcb2
 			     volatile void *page1_ptr)
b1bcb2
 {
b1bcb2
   grub_err_t err;
b1bcb2
-  grub_size_t page_size = mode_info->pitch * mode_info->height;
b1bcb2
+  grub_size_t page_size = 0;
b1bcb2
+
b1bcb2
+  if (grub_mul (mode_info->pitch, mode_info->height, &page_size))
b1bcb2
+    {
b1bcb2
+      /* Shouldn't happen, but if it does we've a bug. */
b1bcb2
+      return GRUB_ERR_BUG;
b1bcb2
+    }
b1bcb2
 
b1bcb2
   framebuffer.offscreen_buffer = grub_malloc (page_size);
b1bcb2
   if (! framebuffer.offscreen_buffer)