Blame SOURCES/0478-gfxmenu-gui-Check-printf-format-in-the-gui_progress_.patch

80913e
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
80913e
From: Thomas Frauendorfer | Miray Software <tf@miray.de>
80913e
Date: Tue, 4 Aug 2020 13:49:51 +0200
80913e
Subject: [PATCH] gfxmenu/gui: Check printf() format in the gui_progress_bar
80913e
 and gui_label
80913e
80913e
The gui_progress_bar and gui_label components can display the timeout
80913e
value. The format string can be set through a theme file. This patch
80913e
adds a validation step to the format string.
80913e
80913e
If a user loads a theme file into the GRUB without this patch then
80913e
a GUI label with the following settings
80913e
80913e
  + label {
80913e
  ...
80913e
  id = "__timeout__"
80913e
  text = "%s"
80913e
  }
80913e
80913e
will interpret the current timeout value as string pointer and print the
80913e
memory at that position on the screen. It is not desired behavior.
80913e
80913e
Signed-off-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
80913e
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
80913e
---
80913e
 grub-core/gfxmenu/gui_label.c        | 4 ++++
80913e
 grub-core/gfxmenu/gui_progress_bar.c | 3 +++
80913e
 2 files changed, 7 insertions(+)
80913e
80913e
diff --git a/grub-core/gfxmenu/gui_label.c b/grub-core/gfxmenu/gui_label.c
b32e65
index a4c817891..1c190542a 100644
80913e
--- a/grub-core/gfxmenu/gui_label.c
80913e
+++ b/grub-core/gfxmenu/gui_label.c
80913e
@@ -193,6 +193,10 @@ label_set_property (void *vself, const char *name, const char *value)
80913e
 	   else if (grub_strcmp (value, "@KEYMAP_SHORT@") == 0)
80913e
 	    value = _("enter: boot, `e': options, `c': cmd-line");
80913e
 	   /* FIXME: Add more templates here if needed.  */
80913e
+
80913e
+	  if (grub_printf_fmt_check(value, "%d") != GRUB_ERR_NONE)
80913e
+	    value = ""; /* Unsupported format. */
80913e
+
80913e
 	  self->template = grub_strdup (value);
80913e
 	  self->text = grub_xasprintf (value, self->value);
80913e
 	}
80913e
diff --git a/grub-core/gfxmenu/gui_progress_bar.c b/grub-core/gfxmenu/gui_progress_bar.c
b32e65
index b128f0866..ace85a125 100644
80913e
--- a/grub-core/gfxmenu/gui_progress_bar.c
80913e
+++ b/grub-core/gfxmenu/gui_progress_bar.c
80913e
@@ -348,6 +348,9 @@ progress_bar_set_property (void *vself, const char *name, const char *value)
80913e
 	   Please use the shortest form available in you language.  */
80913e
 	value = _("%ds");
80913e
 
80913e
+      if (grub_printf_fmt_check(value, "%d") != GRUB_ERR_NONE)
80913e
+	value = ""; /* Unsupported format. */
80913e
+
80913e
       self->template = grub_strdup (value);
80913e
     }
80913e
   else if (grub_strcmp (name, "font") == 0)