Blame SOURCES/0166-misc-fix-invalid-character-recongition-in-strto-l.patch

d9d99f
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
d9d99f
From: Aaron Miller <aaronmiller@fb.com>
d9d99f
Date: Fri, 29 Jul 2016 17:41:27 +0800
d9d99f
Subject: [PATCH] misc: fix invalid character recongition in strto*l
d9d99f
d9d99f
Would previously allow digits larger than the base and didn't check that
d9d99f
subtracting the difference from 0-9 to lowercase letters for characters
d9d99f
larger than 9 didn't result in a value lower than 9, which allowed the
d9d99f
parses: ` = 9, _ = 8, ^ = 7, ] = 6, \ = 5, and [ = 4
d9d99f
---
d9d99f
 grub-core/kern/misc.c | 13 ++++++++-----
d9d99f
 1 file changed, 8 insertions(+), 5 deletions(-)
d9d99f
d9d99f
diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c
d9d99f
index 0e89c483d5e..5c3899f0e5b 100644
d9d99f
--- a/grub-core/kern/misc.c
d9d99f
+++ b/grub-core/kern/misc.c
d9d99f
@@ -434,11 +434,14 @@ grub_strtoull (const char *str, char **end, int base)
d9d99f
       unsigned long digit;
d9d99f
 
d9d99f
       digit = grub_tolower (*str) - '0';
d9d99f
-      if (digit >= 'a' - '0')
d9d99f
-	digit += '0' - 'a' + 10;
d9d99f
-      else if (digit > 9)
d9d99f
-	break;
d9d99f
-
d9d99f
+      if (digit > 9)
d9d99f
+	{
d9d99f
+	  digit += '0' - 'a' + 10;
d9d99f
+	  /* digit <= 9 check is needed to keep chars larger than
d9d99f
+	     '9' but less than 'a' from being read as numbers */
d9d99f
+	  if (digit >= (unsigned long) base || digit <= 9)
d9d99f
+	    break;
d9d99f
+	}
d9d99f
       if (digit >= (unsigned long) base)
d9d99f
 	break;
d9d99f