|
 |
80913e |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
80913e |
From: Chris Coulson <chris.coulson@canonical.com>
|
|
|
80913e |
Date: Wed, 22 Jul 2020 17:06:04 +0100
|
|
|
80913e |
Subject: [PATCH] Fix a regression caused by "efi: fix some malformed device
|
|
|
80913e |
path arithmetic errors"
|
|
|
80913e |
|
|
|
80913e |
This commit introduced a bogus check inside copy_file_path to
|
|
|
80913e |
determine whether the destination grub_efi_file_path_device_path_t
|
|
|
80913e |
was valid before anything was copied to it. Depending on the
|
|
|
80913e |
contents of the heap buffer, this check could fail which would
|
|
|
80913e |
result in copy_file_path returning early.
|
|
|
80913e |
|
|
|
80913e |
Without any error propagated to the caller, make_file_path would
|
|
|
80913e |
then try to advance the invalid device path node with
|
|
|
80913e |
GRUB_EFI_NEXT_DEVICE_PATH, which would also fail, returning a NULL
|
|
|
80913e |
pointer that would subsequently be dereferenced.
|
|
|
80913e |
|
|
|
80913e |
Remove the bogus check, and also propagate errors from copy_file_path.
|
|
|
80913e |
---
|
|
|
80913e |
grub-core/loader/efi/chainloader.c | 26 ++++++++++++++------------
|
|
|
80913e |
1 file changed, 14 insertions(+), 12 deletions(-)
|
|
|
80913e |
|
|
|
80913e |
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
|
|
|
80913e |
index c2411b6dab2..8b99cf23e9d 100644
|
|
|
80913e |
--- a/grub-core/loader/efi/chainloader.c
|
|
|
80913e |
+++ b/grub-core/loader/efi/chainloader.c
|
|
|
80913e |
@@ -115,7 +115,7 @@ grub_chainloader_boot (void)
|
|
|
80913e |
return grub_errno;
|
|
|
80913e |
}
|
|
|
80913e |
|
|
|
80913e |
-static void
|
|
|
80913e |
+static grub_err_t
|
|
|
80913e |
copy_file_path (grub_efi_file_path_device_path_t *fp,
|
|
|
80913e |
const char *str, grub_efi_uint16_t len)
|
|
|
80913e |
{
|
|
|
80913e |
@@ -125,15 +125,9 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
|
|
|
80913e |
fp->header.type = GRUB_EFI_MEDIA_DEVICE_PATH_TYPE;
|
|
|
80913e |
fp->header.subtype = GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE;
|
|
|
80913e |
|
|
|
80913e |
- if (!GRUB_EFI_DEVICE_PATH_VALID ((grub_efi_device_path_t *)fp))
|
|
|
80913e |
- {
|
|
|
80913e |
- grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI Device Path is invalid");
|
|
|
80913e |
- return;
|
|
|
80913e |
- }
|
|
|
80913e |
-
|
|
|
80913e |
path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name));
|
|
|
80913e |
if (!path_name)
|
|
|
80913e |
- return;
|
|
|
80913e |
+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "failed to allocate path buffer");
|
|
|
80913e |
|
|
|
80913e |
size = grub_utf8_to_utf16 (path_name, len * GRUB_MAX_UTF16_PER_UTF8,
|
|
|
80913e |
(const grub_uint8_t *) str, len, 0);
|
|
|
80913e |
@@ -145,6 +139,8 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
|
|
|
80913e |
/* File Path is NULL terminated */
|
|
|
80913e |
fp->path_name[size++] = '\0';
|
|
|
80913e |
fp->header.length = size * sizeof (grub_efi_char16_t) + sizeof (*fp);
|
|
|
80913e |
+ grub_free (path_name);
|
|
|
80913e |
+ return GRUB_ERR_NONE;
|
|
|
80913e |
}
|
|
|
80913e |
|
|
|
80913e |
static grub_efi_device_path_t *
|
|
|
80913e |
@@ -202,13 +198,19 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
|
|
|
80913e |
/* Fill the file path for the directory. */
|
|
|
80913e |
d = (grub_efi_device_path_t *) ((char *) file_path
|
|
|
80913e |
+ ((char *) d - (char *) dp));
|
|
|
80913e |
- copy_file_path ((grub_efi_file_path_device_path_t *) d,
|
|
|
80913e |
- dir_start, dir_end - dir_start);
|
|
|
80913e |
+ if (copy_file_path ((grub_efi_file_path_device_path_t *) d,
|
|
|
80913e |
+ dir_start, dir_end - dir_start) != GRUB_ERR_NONE)
|
|
|
80913e |
+ {
|
|
|
80913e |
+ fail:
|
|
|
80913e |
+ grub_free (file_path);
|
|
|
80913e |
+ return 0;
|
|
|
80913e |
+ }
|
|
|
80913e |
|
|
|
80913e |
/* Fill the file path for the file. */
|
|
|
80913e |
d = GRUB_EFI_NEXT_DEVICE_PATH (d);
|
|
|
80913e |
- copy_file_path ((grub_efi_file_path_device_path_t *) d,
|
|
|
80913e |
- dir_end + 1, grub_strlen (dir_end + 1));
|
|
|
80913e |
+ if (copy_file_path ((grub_efi_file_path_device_path_t *) d,
|
|
|
80913e |
+ dir_end + 1, grub_strlen (dir_end + 1)) != GRUB_ERR_NONE)
|
|
|
80913e |
+ goto fail;
|
|
|
80913e |
|
|
|
80913e |
/* Fill the end of device path nodes. */
|
|
|
80913e |
d = GRUB_EFI_NEXT_DEVICE_PATH (d);
|