Blame SOURCES/0398-disk-lvm-Don-t-go-beyond-the-end-of-the-data-we-read.patch

9723a8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
9723a8
From: Daniel Axtens <dja@axtens.net>
9723a8
Date: Thu, 21 Jan 2021 17:59:14 +1100
9723a8
Subject: [PATCH] disk/lvm: Don't go beyond the end of the data we read from
9723a8
 disk
9723a8
9723a8
We unconditionally trusted offset_xl from the LVM label header, even if
9723a8
it told us that the PV header/disk locations were way off past the end
9723a8
of the data we read from disk.
9723a8
9723a8
Require that the offset be sane, fixing an OOB read and crash.
9723a8
9723a8
Fixes: CID 314367, CID 314371
9723a8
9723a8
Signed-off-by: Daniel Axtens <dja@axtens.net>
9723a8
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
9723a8
---
9723a8
 grub-core/disk/lvm.c | 14 ++++++++++++++
9723a8
 1 file changed, 14 insertions(+)
9723a8
9723a8
diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
9723a8
index 4fbb3eac0ea..0f466040a55 100644
9723a8
--- a/grub-core/disk/lvm.c
9723a8
+++ b/grub-core/disk/lvm.c
9723a8
@@ -142,6 +142,20 @@ grub_lvm_detect (grub_disk_t disk,
9723a8
       goto fail;
9723a8
     }
9723a8
 
9723a8
+  /*
9723a8
+   * We read a grub_lvm_pv_header and then 2 grub_lvm_disk_locns that
9723a8
+   * immediately follow the PV header. Make sure we have space for both.
9723a8
+   */
9723a8
+  if (grub_le_to_cpu32 (lh->offset_xl) >=
9723a8
+      GRUB_LVM_LABEL_SIZE - sizeof (struct grub_lvm_pv_header) -
9723a8
+      2 * sizeof (struct grub_lvm_disk_locn))
9723a8
+    {
9723a8
+#ifdef GRUB_UTIL
9723a8
+      grub_util_info ("LVM PV header/disk locations are beyond the end of the block");
9723a8
+#endif
9723a8
+      goto fail;
9723a8
+    }
9723a8
+
9723a8
   pvh = (struct grub_lvm_pv_header *) (buf + grub_le_to_cpu32(lh->offset_xl));
9723a8
 
9723a8
   for (i = 0, j = 0; i < GRUB_LVM_ID_LEN; i++)