vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

progress: avoid NULL dereference for net files

Browse source 
From original patch by dann frazier <dann.frazier@canonical.com>:

  grub_net_fs_open() saves off a copy of the file structure it gets passed and
  uses it to create a bufio structure. It then overwrites the passed in file
  structure with this new bufio structure. Since file->name doesn't get set
  until we return back to grub_file_open(), it means that only the bufio
  structure gets a valid file->name. The "real" file's name is left
  uninitialized. This leads to a crash when the progress module hook is called
  on it.

grub_net_fs_open() already saved copy of file name as ->net->name, so change
progress module to use it.

Also, grub_file_open may leave file->name as NULL if grub_strdup fails. Check
for it.

Also-By: dann frazier <dann.frazier@canonical.com>
This commit is contained in:
Andrei Borzenkov 2015-10-10 11:44:14 +03:00
parent d31321835e
commit 6e21195890
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
grub-core/lib/progress.c
View file

@ -23,6 +23,7 @@
#include <grub/dl.h>
#include <grub/misc.h>
#include <grub/normal.h>
#include <grub/net.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -70,7 +71,15 @@ grub_file_progress_hook_real (grub_disk_addr_t sector __attribute__ ((unused)),
percent = grub_divmod64 (100 * file->progress_offset,
file->size, 0);
partial_file_name = grub_strrchr (file->name, '/');
/* grub_net_fs_open() saves off partial file structure before name is initialized.
It already saves passed file name in net structure so just use it in this case.
*/
if (file->device->net)
partial_file_name = grub_strrchr (file->device->net->name, '/');
else if (file->name) /* grub_file_open() may leave it as NULL */
partial_file_name = grub_strrchr (file->name, '/');
else
partial_file_name = NULL;
if (partial_file_name)
partial_file_name++;
else