|
 |
1c6ba0 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
1c6ba0 |
From: Daniel Axtens <dja@axtens.net>
|
|
|
1c6ba0 |
Date: Tue, 13 Jul 2021 13:24:38 +1000
|
|
|
1c6ba0 |
Subject: [PATCH] normal/charset: Fix array out-of-bounds formatting unicode
|
|
|
1c6ba0 |
for display
|
|
|
1c6ba0 |
|
|
|
1c6ba0 |
In some cases attempting to display arbitrary binary strings leads
|
|
|
1c6ba0 |
to ASAN splats reading the widthspec array out of bounds.
|
|
|
1c6ba0 |
|
|
|
1c6ba0 |
Check the index. If it would be out of bounds, return a width of 1.
|
|
|
1c6ba0 |
I don't know if that's strictly correct, but we're not really expecting
|
|
|
1c6ba0 |
great display of arbitrary binary data, and it's certainly not worse than
|
|
|
1c6ba0 |
an OOB read.
|
|
|
1c6ba0 |
|
|
|
1c6ba0 |
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
|
1c6ba0 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
1c6ba0 |
(cherry picked from commit fdf32abc7a3928852422c0f291d8cd1dd6b34a8d)
|
|
|
1c6ba0 |
(cherry picked from commit f2c10aaf335b88a69885375c4d68ffab2429df77)
|
|
|
1c6ba0 |
---
|
|
|
1c6ba0 |
grub-core/normal/charset.c | 2 ++
|
|
|
1c6ba0 |
1 file changed, 2 insertions(+)
|
|
|
1c6ba0 |
|
|
|
1c6ba0 |
diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c
|
|
|
1c6ba0 |
index 4dfcc31078..7a5a7c153c 100644
|
|
|
1c6ba0 |
--- a/grub-core/normal/charset.c
|
|
|
1c6ba0 |
+++ b/grub-core/normal/charset.c
|
|
|
1c6ba0 |
@@ -395,6 +395,8 @@ grub_unicode_estimate_width (const struct grub_unicode_glyph *c)
|
|
|
1c6ba0 |
{
|
|
|
1c6ba0 |
if (grub_unicode_get_comb_type (c->base))
|
|
|
1c6ba0 |
return 0;
|
|
|
1c6ba0 |
+ if (((unsigned long) (c->base >> 3)) >= ARRAY_SIZE (widthspec))
|
|
|
1c6ba0 |
+ return 1;
|
|
|
1c6ba0 |
if (widthspec[c->base >> 3] & (1 << (c->base & 7)))
|
|
|
1c6ba0 |
return 2;
|
|
|
1c6ba0 |
else
|