Blame SOURCES/0280-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch

fd0330
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
fd0330
From: Zhang Boyang <zhangboyang.id@gmail.com>
fd0330
Date: Fri, 5 Aug 2022 00:51:20 +0800
fd0330
Subject: [PATCH] font: Fix size overflow in grub_font_get_glyph_internal()
fd0330
fd0330
The length of memory allocation and file read may overflow. This patch
fd0330
fixes the problem by using safemath macros.
fd0330
fd0330
There is a lot of code repetition like "(x * y + 7) / 8". It is unsafe
fd0330
if overflow happens. This patch introduces grub_video_bitmap_calc_1bpp_bufsz().
fd0330
It is safe replacement for such code. It has safemath-like prototype.
fd0330
fd0330
This patch also introduces grub_cast(value, pointer), it casts value to
fd0330
typeof(*pointer) then store the value to *pointer. It returns true when
fd0330
overflow occurs or false if there is no overflow. The semantics of arguments
fd0330
and return value are designed to be consistent with other safemath macros.
fd0330
fd0330
Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com>
fd0330
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
fd0330
(cherry picked from commit 941d10ad6f1dcbd12fb613002249e29ba035f985)
fd0330
---
fd0330
 grub-core/font/font.c   | 17 +++++++++++++----
fd0330
 include/grub/bitmap.h   | 18 ++++++++++++++++++
fd0330
 include/grub/safemath.h |  2 ++
fd0330
 3 files changed, 33 insertions(+), 4 deletions(-)
fd0330
fd0330
diff --git a/grub-core/font/font.c b/grub-core/font/font.c
fd0330
index 2f09a4a55b..6a3fbebbd8 100644
fd0330
--- a/grub-core/font/font.c
fd0330
+++ b/grub-core/font/font.c
fd0330
@@ -739,7 +739,8 @@ grub_font_get_glyph_internal (grub_font_t font, grub_uint32_t code)
fd0330
       grub_int16_t xoff;
fd0330
       grub_int16_t yoff;
fd0330
       grub_int16_t dwidth;
fd0330
-      int len;
fd0330
+      grub_ssize_t len;
fd0330
+      grub_size_t sz;
fd0330
 
fd0330
       if (index_entry->glyph)
fd0330
 	/* Return cached glyph.  */
fd0330
@@ -768,9 +769,17 @@ grub_font_get_glyph_internal (grub_font_t font, grub_uint32_t code)
fd0330
 	  return 0;
fd0330
 	}
fd0330
 
fd0330
-      len = (width * height + 7) / 8;
fd0330
-      glyph = grub_malloc (sizeof (struct grub_font_glyph) + len);
fd0330
-      if (!glyph)
fd0330
+      /* Calculate real struct size of current glyph. */
fd0330
+      if (grub_video_bitmap_calc_1bpp_bufsz (width, height, &len) ||
fd0330
+	  grub_add (sizeof (struct grub_font_glyph), len, &sz))
fd0330
+	{
fd0330
+	  remove_font (font);
fd0330
+	  return 0;
fd0330
+	}
fd0330
+
fd0330
+      /* Allocate and initialize the glyph struct. */
fd0330
+      glyph = grub_malloc (sz);
fd0330
+      if (glyph == NULL)
fd0330
 	{
fd0330
 	  remove_font (font);
fd0330
 	  return 0;
fd0330
diff --git a/include/grub/bitmap.h b/include/grub/bitmap.h
fd0330
index 5728f8ca3a..0d9603f619 100644
fd0330
--- a/include/grub/bitmap.h
fd0330
+++ b/include/grub/bitmap.h
fd0330
@@ -23,6 +23,7 @@
fd0330
 #include <grub/symbol.h>
fd0330
 #include <grub/types.h>
fd0330
 #include <grub/video.h>
fd0330
+#include <grub/safemath.h>
fd0330
 
fd0330
 struct grub_video_bitmap
fd0330
 {
fd0330
@@ -79,6 +80,23 @@ grub_video_bitmap_get_height (struct grub_video_bitmap *bitmap)
fd0330
   return bitmap->mode_info.height;
fd0330
 }
fd0330
 
fd0330
+/*
fd0330
+ * Calculate and store the size of data buffer of 1bit bitmap in result.
fd0330
+ * Equivalent to "*result = (width * height + 7) / 8" if no overflow occurs.
fd0330
+ * Return true when overflow occurs or false if there is no overflow.
fd0330
+ * This function is intentionally implemented as a macro instead of
fd0330
+ * an inline function. Although a bit awkward, it preserves data types for
fd0330
+ * safemath macros and reduces macro side effects as much as possible.
fd0330
+ *
fd0330
+ * XXX: Will report false overflow if width * height > UINT64_MAX.
fd0330
+ */
fd0330
+#define grub_video_bitmap_calc_1bpp_bufsz(width, height, result) \
fd0330
+({ \
fd0330
+  grub_uint64_t _bitmap_pixels; \
fd0330
+  grub_mul ((width), (height), &_bitmap_pixels) ? 1 : \
fd0330
+    grub_cast (_bitmap_pixels / GRUB_CHAR_BIT + !!(_bitmap_pixels % GRUB_CHAR_BIT), (result)); \
fd0330
+})
fd0330
+
fd0330
 void EXPORT_FUNC (grub_video_bitmap_get_mode_info) (struct grub_video_bitmap *bitmap,
fd0330
 						    struct grub_video_mode_info *mode_info);
fd0330
 
fd0330
diff --git a/include/grub/safemath.h b/include/grub/safemath.h
fd0330
index c17b89bba1..bb0f826de1 100644
fd0330
--- a/include/grub/safemath.h
fd0330
+++ b/include/grub/safemath.h
fd0330
@@ -30,6 +30,8 @@
fd0330
 #define grub_sub(a, b, res)	__builtin_sub_overflow(a, b, res)
fd0330
 #define grub_mul(a, b, res)	__builtin_mul_overflow(a, b, res)
fd0330
 
fd0330
+#define grub_cast(a, res)	grub_add ((a), 0, (res))
fd0330
+
fd0330
 #else
fd0330
 #error gcc 5.1 or newer or clang 3.8 or newer is required
fd0330
 #endif