From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Kiper Date: Tue, 7 Jul 2020 15:36:26 +0200 Subject: [PATCH] font: Do not load more than one NAME section The GRUB font file can have one NAME section only. Though if somebody crafts a broken font file with many NAME sections and loads it then the GRUB leaks memory. So, prevent against that by loading first NAME section and failing in controlled way on following one. Reported-by: Chris Coulson Signed-off-by: Daniel Kiper Reviewed-by: Jan Setje-Eilers Upstream-commit-id: 482814113dc --- grub-core/font/font.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/grub-core/font/font.c b/grub-core/font/font.c index d63354fb51b..a7b955a1a74 100644 --- a/grub-core/font/font.c +++ b/grub-core/font/font.c @@ -532,6 +532,12 @@ grub_font_load (const char *filename) if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME, sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0) { + if (font->name != NULL) + { + grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections"); + goto fail; + } + font->name = read_section_as_string (§ion); if (!font->name) goto fail;