vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

font: Do not load more than one NAME section

Browse source 
The GRUB font file can have one NAME section only. Though if somebody
crafts a broken font file with many NAME sections and loads it then the
GRUB leaks memory. So, prevent against that by loading first NAME
section and failing in controlled way on following one.

Reported-by: Chris Coulson <chris.coulson@canonical.com>
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
This commit is contained in:
Daniel Kiper 2020-07-07 15:36:26 +02:00
parent 2a1edcf2ed
commit 89f3da1a3d
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
grub-core/font/font.c
View file

@ -532,6 +532,12 @@ grub_font_load (const char *filename)
if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME,
sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0)
{
if (font->name != NULL)
{
grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections");
goto fail;
}
font->name = read_section_as_string (&section);
if (!font->name)
goto fail;