|
 |
b1bcb2 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b1bcb2 |
From: Daniel Axtens <dja@axtens.net>
|
|
|
b1bcb2 |
Date: Fri, 22 Jan 2021 17:10:48 +1100
|
|
|
b1bcb2 |
Subject: [PATCH] commands/menuentry: Fix quoting in setparams_prefix()
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Commit 9acdcbf32542 (use single quotes in menuentry setparams command)
|
|
|
b1bcb2 |
says that expressing a quoted single quote will require 3 characters. It
|
|
|
b1bcb2 |
actually requires (and always did require!) 4 characters:
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
str: a'b => a'\''b
|
|
|
b1bcb2 |
len: 3 => 6 (2 for the letters + 4 for the quote)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
This leads to not allocating enough memory and thus out of bounds writes
|
|
|
b1bcb2 |
that have been observed to cause heap corruption.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Allocate 4 bytes for each single quote.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Commit 22e7dbb2bb81 (Fix quoting in legacy parser.) does the same
|
|
|
b1bcb2 |
quoting, but it adds 3 as extra overhead on top of the single byte that
|
|
|
b1bcb2 |
the quote already needs. So it's correct.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Fixes: CVE-2021-20233
|
|
|
b1bcb2 |
Fixes: 9acdcbf32542 (use single quotes in menuentry setparams command)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
|
b1bcb2 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b1bcb2 |
---
|
|
|
b1bcb2 |
grub-core/commands/menuentry.c | 2 +-
|
|
|
b1bcb2 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
|
|
|
b1bcb2 |
index 16c52ed00e8..4ad524afbc3 100644
|
|
|
b1bcb2 |
--- a/grub-core/commands/menuentry.c
|
|
|
b1bcb2 |
+++ b/grub-core/commands/menuentry.c
|
|
|
b1bcb2 |
@@ -230,7 +230,7 @@ setparams_prefix (int argc, char **args)
|
|
|
b1bcb2 |
len += 3; /* 3 = 1 space + 2 quotes */
|
|
|
b1bcb2 |
p = args[i];
|
|
|
b1bcb2 |
while (*p)
|
|
|
b1bcb2 |
- len += (*p++ == '\'' ? 3 : 1);
|
|
|
b1bcb2 |
+ len += (*p++ == '\'' ? 4 : 1);
|
|
|
b1bcb2 |
}
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
result = grub_malloc (len + 2);
|