Blame SOURCES/0246-normal-charset-Fix-array-out-of-bounds-formatting-un.patch

1c6ba0
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
1c6ba0
From: Daniel Axtens <dja@axtens.net>
1c6ba0
Date: Tue, 13 Jul 2021 13:24:38 +1000
1c6ba0
Subject: [PATCH] normal/charset: Fix array out-of-bounds formatting unicode
1c6ba0
 for display
1c6ba0
1c6ba0
In some cases attempting to display arbitrary binary strings leads
1c6ba0
to ASAN splats reading the widthspec array out of bounds.
1c6ba0
1c6ba0
Check the index. If it would be out of bounds, return a width of 1.
1c6ba0
I don't know if that's strictly correct, but we're not really expecting
1c6ba0
great display of arbitrary binary data, and it's certainly not worse than
1c6ba0
an OOB read.
1c6ba0
1c6ba0
Signed-off-by: Daniel Axtens <dja@axtens.net>
1c6ba0
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
1c6ba0
(cherry picked from commit fdf32abc7a3928852422c0f291d8cd1dd6b34a8d)
1c6ba0
(cherry picked from commit f2c10aaf335b88a69885375c4d68ffab2429df77)
1c6ba0
---
1c6ba0
 grub-core/normal/charset.c | 2 ++
1c6ba0
 1 file changed, 2 insertions(+)
1c6ba0
1c6ba0
diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c
1c6ba0
index 4dfcc31078..7a5a7c153c 100644
1c6ba0
--- a/grub-core/normal/charset.c
1c6ba0
+++ b/grub-core/normal/charset.c
1c6ba0
@@ -395,6 +395,8 @@ grub_unicode_estimate_width (const struct grub_unicode_glyph *c)
1c6ba0
 {
1c6ba0
   if (grub_unicode_get_comb_type (c->base))
1c6ba0
     return 0;
1c6ba0
+  if (((unsigned long) (c->base >> 3)) >= ARRAY_SIZE (widthspec))
1c6ba0
+    return 1;
1c6ba0
   if (widthspec[c->base >> 3] & (1 << (c->base & 7)))
1c6ba0
     return 2;
1c6ba0
   else