dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0442-efi-net-Fix-malformed-device-path-arithmetic-errors-.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Thomas Frauendorfer | Miray Software <tf@miray.de>
b1bcb2
Date: Tue, 4 Aug 2020 17:13:05 +0200
b1bcb2
Subject: [PATCH] efi/net: Fix malformed device path arithmetic errors in efi
b1bcb2
 net methods
b1bcb2
b1bcb2
---
b1bcb2
 grub-core/net/efi/net.c | 26 ++++++++++++++++++++------
b1bcb2
 1 file changed, 20 insertions(+), 6 deletions(-)
b1bcb2
b1bcb2
diff --git a/grub-core/net/efi/net.c b/grub-core/net/efi/net.c
b1bcb2
index 86bcae281a7..4a37523dd1f 100644
b1bcb2
--- a/grub-core/net/efi/net.c
b1bcb2
+++ b/grub-core/net/efi/net.c
b1bcb2
@@ -1318,11 +1318,18 @@ grub_efi_net_boot_from_https (void)
b1bcb2
 
b1bcb2
   dp = grub_efi_get_device_path (image->device_handle);
b1bcb2
 
b1bcb2
-  while (1)
b1bcb2
+  while (dp)
b1bcb2
     {
b1bcb2
+      grub_efi_uint16_t len = GRUB_EFI_DEVICE_PATH_LENGTH (dp);
b1bcb2
+      if (len < 4)
b1bcb2
+      {
b1bcb2
+	grub_error(GRUB_ERR_OUT_OF_RANGE,
b1bcb2
+		   "malformed EFI Device Path node has length=%d", len);
b1bcb2
+	break;
b1bcb2
+      }
b1bcb2
+
b1bcb2
       grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp);
b1bcb2
       grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp);
b1bcb2
-      grub_efi_uint16_t len = GRUB_EFI_DEVICE_PATH_LENGTH (dp);
b1bcb2
 
b1bcb2
       if ((type == GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE)
b1bcb2
 	  && (subtype == GRUB_EFI_URI_DEVICE_PATH_SUBTYPE))
b1bcb2
@@ -1335,7 +1342,7 @@ grub_efi_net_boot_from_https (void)
b1bcb2
 
b1bcb2
       if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp))
b1bcb2
         break;
b1bcb2
-      dp = (grub_efi_device_path_t *) ((char *) dp + len);
b1bcb2
+      dp = GRUB_EFI_NEXT_DEVICE_PATH(dp);
b1bcb2
     }
b1bcb2
 
b1bcb2
   return 0;
b1bcb2
@@ -1353,11 +1360,18 @@ grub_efi_net_boot_from_opa (void)
b1bcb2
 
b1bcb2
   dp = grub_efi_get_device_path (image->device_handle);
b1bcb2
 
b1bcb2
-  while (1)
b1bcb2
+  while (dp)
b1bcb2
     {
b1bcb2
+      grub_efi_uint16_t len = GRUB_EFI_DEVICE_PATH_LENGTH (dp);
b1bcb2
+      if (len < 4)
b1bcb2
+      {
b1bcb2
+	grub_error(GRUB_ERR_OUT_OF_RANGE,
b1bcb2
+		   "malformed EFI Device Path node has length=%d", len);
b1bcb2
+	break;
b1bcb2
+      }
b1bcb2
+
b1bcb2
       grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp);
b1bcb2
       grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp);
b1bcb2
-      grub_efi_uint16_t len = GRUB_EFI_DEVICE_PATH_LENGTH (dp);
b1bcb2
 
b1bcb2
       if ((type == GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE)
b1bcb2
 	  && (subtype == GRUB_EFI_MAC_ADDRESS_DEVICE_PATH_SUBTYPE))
b1bcb2
@@ -1368,7 +1382,7 @@ grub_efi_net_boot_from_opa (void)
b1bcb2
 
b1bcb2
       if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp))
b1bcb2
         break;
b1bcb2
-      dp = (grub_efi_device_path_t *) ((char *) dp + len);
b1bcb2
+      dp = GRUB_EFI_NEXT_DEVICE_PATH(dp);
b1bcb2
     }
b1bcb2
 
b1bcb2
   return 0;