vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

grub-core/fs/minix.c (grub_minix_read_file): Avoid reading past the end of file.

Browse source
This commit is contained in:
Vladimir Serbinenko 2015-01-20 13:55:55 +01:00
parent af435524cd
commit 30e177a05b
3 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
ChangeLog
View file

@ -1,3 +1,13 @@
2015-01-20 Vladimir Serbinenko <phcoder@gmail.com>
* grub-core/bus/usb/usbtrans.c (grub_usb_bulk_maxpacket): Avoid
potentially returning 0.
2015-01-20 Vladimir Serbinenko <phcoder@gmail.com>
* grub-core/fs/minix.c (grub_minix_read_file): Avoid reading past
the end of file.
2015-01-20 Vladimir Serbinenko <phcoder@gmail.com> 2015-01-20 Vladimir Serbinenko <phcoder@gmail.com>
* grub-core/fs/fshelp.c (grub_fshelp_read_file): Don't attempt to read * grub-core/fs/fshelp.c (grub_fshelp_read_file): Don't attempt to read

2
grub-core/bus/usb/usbtrans.c
View file

@ -31,7 +31,7 @@ grub_usb_bulk_maxpacket (grub_usb_device_t dev,
struct grub_usb_desc_endp *endpoint) struct grub_usb_desc_endp *endpoint)
{ {
/* Use the maximum packet size given in the endpoint descriptor. */ /* Use the maximum packet size given in the endpoint descriptor. */
if (dev->initialized && endpoint) if (dev->initialized && endpoint && (unsigned int) endpoint->maxpacket)
return endpoint->maxpacket; return endpoint->maxpacket;
return 64; return 64;

7
grub-core/fs/minix.c
View file

@ -262,6 +262,13 @@ grub_minix_read_file (struct grub_minix_data *data,
grub_uint32_t posblock; grub_uint32_t posblock;
grub_uint32_t blockoff; grub_uint32_t blockoff;
if (pos > GRUB_MINIX_INODE_SIZE (data))
{
grub_error (GRUB_ERR_OUT_OF_RANGE,
N_("attempt to read past the end of file"));
return -1;
}
/* Adjust len so it we can't read past the end of the file. */ /* Adjust len so it we can't read past the end of the file. */
if (len + pos > GRUB_MINIX_INODE_SIZE (data)) if (len + pos > GRUB_MINIX_INODE_SIZE (data))
len = GRUB_MINIX_INODE_SIZE (data) - pos; len = GRUB_MINIX_INODE_SIZE (data) - pos;