|
 |
b1bcb2 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b1bcb2 |
From: Daniel Axtens <dja@axtens.net>
|
|
|
b1bcb2 |
Date: Fri, 15 Jan 2021 20:03:20 +1100
|
|
|
b1bcb2 |
Subject: [PATCH] term/gfxterm: Don't set up a font with glyphs that are too
|
|
|
b1bcb2 |
big
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Catch the case where we have a font so big that it causes the number of
|
|
|
b1bcb2 |
rows or columns to be 0. Currently we continue and allocate a
|
|
|
b1bcb2 |
virtual_screen.text_buffer of size 0. We then try to use that for glpyhs
|
|
|
b1bcb2 |
and things go badly.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
On the emu platform, malloc() may give us a valid pointer, in which case
|
|
|
b1bcb2 |
we'll access heap memory which we shouldn't. Alternatively, it may give us
|
|
|
b1bcb2 |
NULL, in which case we'll crash. For other platforms, if I understand
|
|
|
b1bcb2 |
grub_memalign() correctly, we will receive a valid but small allocation
|
|
|
b1bcb2 |
that we will very likely later overrun.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Prevent the creation of a virtual screen that isn't at least 40 cols
|
|
|
b1bcb2 |
by 12 rows. This is arbitrary, but it seems that if your width or height
|
|
|
b1bcb2 |
is half a standard 80x24 terminal, you're probably going to struggle to
|
|
|
b1bcb2 |
read anything anyway.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
|
b1bcb2 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b1bcb2 |
---
|
|
|
b1bcb2 |
grub-core/term/gfxterm.c | 9 +++++++++
|
|
|
b1bcb2 |
1 file changed, 9 insertions(+)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
diff --git a/grub-core/term/gfxterm.c b/grub-core/term/gfxterm.c
|
|
|
b1bcb2 |
index dc0669b354d..b68cce809d5 100644
|
|
|
b1bcb2 |
--- a/grub-core/term/gfxterm.c
|
|
|
b1bcb2 |
+++ b/grub-core/term/gfxterm.c
|
|
|
b1bcb2 |
@@ -230,6 +230,15 @@ grub_virtual_screen_setup (unsigned int x, unsigned int y,
|
|
|
b1bcb2 |
virtual_screen.columns = virtual_screen.width / virtual_screen.normal_char_width;
|
|
|
b1bcb2 |
virtual_screen.rows = virtual_screen.height / virtual_screen.normal_char_height;
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
+ /*
|
|
|
b1bcb2 |
+ * There must be a minimum number of rows and columns for the screen to
|
|
|
b1bcb2 |
+ * make sense. Arbitrarily pick half of 80x24. If either dimensions is 0
|
|
|
b1bcb2 |
+ * we would allocate 0 bytes for the text_buffer.
|
|
|
b1bcb2 |
+ */
|
|
|
b1bcb2 |
+ if (virtual_screen.columns < 40 || virtual_screen.rows < 12)
|
|
|
b1bcb2 |
+ return grub_error (GRUB_ERR_BAD_FONT,
|
|
|
b1bcb2 |
+ "font: glyphs too large to fit on screen");
|
|
|
b1bcb2 |
+
|
|
|
b1bcb2 |
/* Allocate memory for text buffer. */
|
|
|
b1bcb2 |
virtual_screen.text_buffer =
|
|
|
b1bcb2 |
(struct grub_colored_char *) grub_malloc (virtual_screen.columns
|