vbatts
/
grub
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix security issue when reading username and password 

This patch fixes two integer underflows at:
  * grub-core/lib/crypto.c
  * grub-core/normal/auth.c

CVE-2015-8370

Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
Signed-off-by: Ismael Ripoll-Ripoll <iripoll@disca.upv.es>
Also-By: Andrey Borzenkov <arvidjaar@gmail.com>
This commit is contained in:
Hector Marco-Gisbert 2015-12-16 07:57:18 +03:00 committed by Andrei Borzenkov
parent ff5726b878
commit 451d80e52d
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
grub-core/lib/crypto.c
View File

@ -470,7 +470,8 @@ grub_password_get (char buf[], unsigned buf_size)
if (key == '\b')
{
cur_len--;
if (cur_len)
cur_len--;
continue;
}

7
grub-core/normal/auth.c
View File

@ -174,8 +174,11 @@ grub_username_get (char buf[], unsigned buf_size)
if (key == '\b')
{
cur_len--;
grub_printf ("\b");
if (cur_len)
{
cur_len--;
grub_printf ("\b");
}
continue;
}