nalika / rpms / grub2

Forked from rpms/grub2 2 years ago
Clone

Blame SOURCES/0438-fs-fshelp-Catch-impermissibly-large-block-sizes-in-r.patch

468bd4
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
468bd4
From: Daniel Axtens <dja@axtens.net>
468bd4
Date: Mon, 18 Jan 2021 11:46:39 +1100
468bd4
Subject: [PATCH] fs/fshelp: Catch impermissibly large block sizes in read
468bd4
 helper
468bd4
468bd4
A fuzzed HFS+ filesystem had log2blocksize = 22. This gave
468bd4
log2blocksize + GRUB_DISK_SECTOR_BITS = 31. 1 << 31 = 0x80000000,
468bd4
which is -1 as an int. This caused some wacky behavior later on in
468bd4
the function, leading to out-of-bounds writes on the destination buffer.
468bd4
468bd4
Catch log2blocksize + GRUB_DISK_SECTOR_BITS >= 31. We could be stricter,
468bd4
but this is the minimum that will prevent integer size weirdness.
468bd4
468bd4
Signed-off-by: Daniel Axtens <dja@axtens.net>
468bd4
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
468bd4
---
468bd4
 grub-core/fs/fshelp.c | 12 ++++++++++++
468bd4
 1 file changed, 12 insertions(+)
468bd4
468bd4
diff --git a/grub-core/fs/fshelp.c b/grub-core/fs/fshelp.c
468bd4
index 4c902adf381..a2d0d297a52 100644
468bd4
--- a/grub-core/fs/fshelp.c
468bd4
+++ b/grub-core/fs/fshelp.c
468bd4
@@ -362,6 +362,18 @@ grub_fshelp_read_file (grub_disk_t disk, grub_fshelp_node_t node,
468bd4
   grub_disk_addr_t i, blockcnt;
468bd4
   int blocksize = 1 << (log2blocksize + GRUB_DISK_SECTOR_BITS);
468bd4
 
468bd4
+  /*
468bd4
+   * Catch blatantly invalid log2blocksize. We could be a lot stricter, but
468bd4
+   * this is the most permissive we can be before we start to see integer
468bd4
+   * overflow/underflow issues.
468bd4
+   */
468bd4
+  if (log2blocksize + GRUB_DISK_SECTOR_BITS >= 31)
468bd4
+    {
468bd4
+      grub_error (GRUB_ERR_OUT_OF_RANGE,
468bd4
+		  N_("blocksize too large"));
468bd4
+      return -1;
468bd4
+    }
468bd4
+
468bd4
   if (pos > filesize)
468bd4
     {
468bd4
       grub_error (GRUB_ERR_OUT_OF_RANGE,