Blame SOURCES/0527-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch

bf0270
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
bf0270
From: Daniel Axtens <dja@axtens.net>
bf0270
Date: Mon, 20 Dec 2021 21:55:43 +1100
bf0270
Subject: [PATCH] net/dns: Don't read past the end of the string we're checking
bf0270
 against
bf0270
bf0270
I don't really understand what's going on here but fuzzing found
bf0270
a bug where we read past the end of check_with. That's a C string,
bf0270
so use grub_strlen() to make sure we don't overread it.
bf0270
bf0270
Signed-off-by: Daniel Axtens <dja@axtens.net>
bf0270
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
bf0270
(cherry picked from commit 6a97b3f4b1d5173aa516edc6dedbc63de7306d21)
bf0270
(cherry picked from commit e0589624e86bc96666cbdb62f6e55cafec2871b3)
bf0270
(cherry picked from commit 95ecbc0b9aacfd43ba96cccc50daaf39eccd9f7f)
bf0270
---
bf0270
 grub-core/net/dns.c | 19 ++++++++++++++++---
bf0270
 1 file changed, 16 insertions(+), 3 deletions(-)
bf0270
bf0270
diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c
bf0270
index 135faac035..17961a9f18 100644
bf0270
--- a/grub-core/net/dns.c
bf0270
+++ b/grub-core/net/dns.c
bf0270
@@ -146,11 +146,18 @@ check_name_real (const grub_uint8_t *name_at, const grub_uint8_t *head,
bf0270
 		 int *length, char *set)
bf0270
 {
bf0270
   const char *readable_ptr = check_with;
bf0270
+  int readable_len;
bf0270
   const grub_uint8_t *ptr;
bf0270
   char *optr = set;
bf0270
   int bytes_processed = 0;
bf0270
   if (length)
bf0270
     *length = 0;
bf0270
+
bf0270
+  if (readable_ptr != NULL)
bf0270
+    readable_len = grub_strlen (readable_ptr);
bf0270
+  else
bf0270
+    readable_len = 0;
bf0270
+
bf0270
   for (ptr = name_at; ptr < tail && bytes_processed < tail - head + 2; )
bf0270
     {
bf0270
       /* End marker.  */
bf0270
@@ -172,13 +179,16 @@ check_name_real (const grub_uint8_t *name_at, const grub_uint8_t *head,
bf0270
 	  ptr = head + (((ptr[0] & 0x3f) << 8) | ptr[1]);
bf0270
 	  continue;
bf0270
 	}
bf0270
-      if (readable_ptr && grub_memcmp (ptr + 1, readable_ptr, *ptr) != 0)
bf0270
+      if (readable_ptr != NULL && (*ptr > readable_len || grub_memcmp (ptr + 1, readable_ptr, *ptr) != 0))
bf0270
 	return 0;
bf0270
       if (grub_memchr (ptr + 1, 0, *ptr) 
bf0270
 	  || grub_memchr (ptr + 1, '.', *ptr))
bf0270
 	return 0;
bf0270
       if (readable_ptr)
bf0270
-	readable_ptr += *ptr;
bf0270
+	{
bf0270
+	  readable_ptr += *ptr;
bf0270
+	  readable_len -= *ptr;
bf0270
+	}
bf0270
       if (readable_ptr && *readable_ptr != '.' && *readable_ptr != 0)
bf0270
 	return 0;
bf0270
       bytes_processed += *ptr + 1;
bf0270
@@ -192,7 +202,10 @@ check_name_real (const grub_uint8_t *name_at, const grub_uint8_t *head,
bf0270
       if (optr)
bf0270
 	*optr++ = '.';
bf0270
       if (readable_ptr && *readable_ptr)
bf0270
-	readable_ptr++;
bf0270
+	{
bf0270
+	  readable_ptr++;
bf0270
+	  readable_len--;
bf0270
+	}
bf0270
       ptr += *ptr + 1;
bf0270
     }
bf0270
   return 0;