|
 |
468bd4 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
468bd4 |
From: Daniel Axtens <dja@axtens.net>
|
|
|
468bd4 |
Date: Mon, 18 Jan 2021 11:46:39 +1100
|
|
|
468bd4 |
Subject: [PATCH] fs/fshelp: Catch impermissibly large block sizes in read
|
|
|
468bd4 |
helper
|
|
|
468bd4 |
|
|
|
468bd4 |
A fuzzed HFS+ filesystem had log2blocksize = 22. This gave
|
|
|
468bd4 |
log2blocksize + GRUB_DISK_SECTOR_BITS = 31. 1 << 31 = 0x80000000,
|
|
|
468bd4 |
which is -1 as an int. This caused some wacky behavior later on in
|
|
|
468bd4 |
the function, leading to out-of-bounds writes on the destination buffer.
|
|
|
468bd4 |
|
|
|
468bd4 |
Catch log2blocksize + GRUB_DISK_SECTOR_BITS >= 31. We could be stricter,
|
|
|
468bd4 |
but this is the minimum that will prevent integer size weirdness.
|
|
|
468bd4 |
|
|
|
468bd4 |
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
|
468bd4 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
468bd4 |
---
|
|
|
468bd4 |
grub-core/fs/fshelp.c | 12 ++++++++++++
|
|
|
468bd4 |
1 file changed, 12 insertions(+)
|
|
|
468bd4 |
|
|
|
468bd4 |
diff --git a/grub-core/fs/fshelp.c b/grub-core/fs/fshelp.c
|
|
|
f6e916 |
index 4c902adf3..a2d0d297a 100644
|
|
|
468bd4 |
--- a/grub-core/fs/fshelp.c
|
|
|
468bd4 |
+++ b/grub-core/fs/fshelp.c
|
|
|
468bd4 |
@@ -362,6 +362,18 @@ grub_fshelp_read_file (grub_disk_t disk, grub_fshelp_node_t node,
|
|
|
468bd4 |
grub_disk_addr_t i, blockcnt;
|
|
|
468bd4 |
int blocksize = 1 << (log2blocksize + GRUB_DISK_SECTOR_BITS);
|
|
|
468bd4 |
|
|
|
468bd4 |
+ /*
|
|
|
468bd4 |
+ * Catch blatantly invalid log2blocksize. We could be a lot stricter, but
|
|
|
468bd4 |
+ * this is the most permissive we can be before we start to see integer
|
|
|
468bd4 |
+ * overflow/underflow issues.
|
|
|
468bd4 |
+ */
|
|
|
468bd4 |
+ if (log2blocksize + GRUB_DISK_SECTOR_BITS >= 31)
|
|
|
468bd4 |
+ {
|
|
|
468bd4 |
+ grub_error (GRUB_ERR_OUT_OF_RANGE,
|
|
|
468bd4 |
+ N_("blocksize too large"));
|
|
|
468bd4 |
+ return -1;
|
|
|
468bd4 |
+ }
|
|
|
468bd4 |
+
|
|
|
468bd4 |
if (pos > filesize)
|
|
|
468bd4 |
{
|
|
|
468bd4 |
grub_error (GRUB_ERR_OUT_OF_RANGE,
|