Blame SOURCES/0287-font-Do-not-load-more-than-one-NAME-section.patch

9723a8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
c294fc
From: Daniel Kiper <daniel.kiper@oracle.com>
c294fc
Date: Tue, 7 Jul 2020 15:36:26 +0200
9723a8
Subject: [PATCH] font: Do not load more than one NAME section
c294fc
c294fc
The GRUB font file can have one NAME section only. Though if somebody
c294fc
crafts a broken font file with many NAME sections and loads it then the
c294fc
GRUB leaks memory. So, prevent against that by loading first NAME
c294fc
section and failing in controlled way on following one.
c294fc
c294fc
Reported-by: Chris Coulson <chris.coulson@canonical.com>
c294fc
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
c294fc
Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
c294fc
Upstream-commit-id: 482814113dc
c294fc
---
c294fc
 grub-core/font/font.c | 6 ++++++
c294fc
 1 file changed, 6 insertions(+)
c294fc
c294fc
diff --git a/grub-core/font/font.c b/grub-core/font/font.c
c294fc
index d63354fb51b..a7b955a1a74 100644
c294fc
--- a/grub-core/font/font.c
c294fc
+++ b/grub-core/font/font.c
c294fc
@@ -532,6 +532,12 @@ grub_font_load (const char *filename)
c294fc
       if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME,
c294fc
 		       sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0)
c294fc
 	{
c294fc
+	  if (font->name != NULL)
c294fc
+	    {
c294fc
+	      grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections");
c294fc
+	      goto fail;
c294fc
+	    }
c294fc
+
c294fc
 	  font->name = read_section_as_string (&section);
c294fc
 	  if (!font->name)
c294fc
 	    goto fail;