dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0394-commands-menuentry-Fix-quoting-in-setparams_prefix.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Daniel Axtens <dja@axtens.net>
b1bcb2
Date: Fri, 22 Jan 2021 17:10:48 +1100
b1bcb2
Subject: [PATCH] commands/menuentry: Fix quoting in setparams_prefix()
b1bcb2
b1bcb2
Commit 9acdcbf32542 (use single quotes in menuentry setparams command)
b1bcb2
says that expressing a quoted single quote will require 3 characters. It
b1bcb2
actually requires (and always did require!) 4 characters:
b1bcb2
b1bcb2
  str: a'b => a'\''b
b1bcb2
  len:  3  => 6 (2 for the letters + 4 for the quote)
b1bcb2
b1bcb2
This leads to not allocating enough memory and thus out of bounds writes
b1bcb2
that have been observed to cause heap corruption.
b1bcb2
b1bcb2
Allocate 4 bytes for each single quote.
b1bcb2
b1bcb2
Commit 22e7dbb2bb81 (Fix quoting in legacy parser.) does the same
b1bcb2
quoting, but it adds 3 as extra overhead on top of the single byte that
b1bcb2
the quote already needs. So it's correct.
b1bcb2
b1bcb2
Fixes: CVE-2021-20233
b1bcb2
Fixes: 9acdcbf32542 (use single quotes in menuentry setparams command)
b1bcb2
b1bcb2
Signed-off-by: Daniel Axtens <dja@axtens.net>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/commands/menuentry.c | 2 +-
b1bcb2
 1 file changed, 1 insertion(+), 1 deletion(-)
b1bcb2
b1bcb2
diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
b1bcb2
index 16c52ed00e8..4ad524afbc3 100644
b1bcb2
--- a/grub-core/commands/menuentry.c
b1bcb2
+++ b/grub-core/commands/menuentry.c
b1bcb2
@@ -230,7 +230,7 @@ setparams_prefix (int argc, char **args)
b1bcb2
       len += 3; /* 3 = 1 space + 2 quotes */
b1bcb2
       p = args[i];
b1bcb2
       while (*p)
b1bcb2
-	len += (*p++ == '\'' ? 3 : 1);
b1bcb2
+	len += (*p++ == '\'' ? 4 : 1);
b1bcb2
     }
b1bcb2
 
b1bcb2
   result = grub_malloc (len + 2);