vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

yylex: Make lexer fatal errors actually be fatal

Browse source 
When presented with a command that can't be tokenized to anything
smaller than YYLMAX characters, the parser calls YY_FATAL_ERROR(errmsg),
expecting that will stop further processing, as such:

  #define YY_DO_BEFORE_ACTION \
        yyg->yytext_ptr = yy_bp; \
        yyleng = (int) (yy_cp - yy_bp); \
        yyg->yy_hold_char = *yy_cp; \
        *yy_cp = '\0'; \
        if ( yyleng >= YYLMAX ) \
                YY_FATAL_ERROR( "token too large, exceeds YYLMAX" ); \
        yy_flex_strncpy( yytext, yyg->yytext_ptr, yyleng + 1 , yyscanner); \
        yyg->yy_c_buf_p = yy_cp;

The code flex generates expects that YY_FATAL_ERROR() will either return
for it or do some form of longjmp(), or handle the error in some way at
least, and so the strncpy() call isn't in an "else" clause, and thus if
YY_FATAL_ERROR() is *not* actually fatal, it does the call with the
questionable limit, and predictable results ensue.

Unfortunately, our implementation of YY_FATAL_ERROR() is:

   #define YY_FATAL_ERROR(msg)                     \
     do {                                          \
       grub_printf (_("fatal error: %s\n"), _(msg));     \
     } while (0)

The same pattern exists in yyless(), and similar problems exist in users
of YY_INPUT(), several places in the main parsing loop,
yy_get_next_buffer(), yy_load_buffer_state(), yyensure_buffer_stack,
yy_scan_buffer(), etc.

All of these callers expect YY_FATAL_ERROR() to actually be fatal, and
the things they do if it returns after calling it are wildly unsafe.

Fixes: CVE-2020-10713

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Peter Jones 2020-04-15 15:45:02 -04:00 committed by Daniel Kiper
parent 6a34fdb76a
commit a4d3fbdff1
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
grub-core/script/yylex.l
View file

@ -37,11 +37,11 @@
/* /*
* As we don't have access to yyscanner, we cannot do much except to * As we don't have access to yyscanner, we cannot do much except to
* print the fatal error. * print the fatal error and exit.
*/ */
#define YY_FATAL_ERROR(msg) \ #define YY_FATAL_ERROR(msg) \
do { \ do { \
grub_printf (_("fatal error: %s\n"), _(msg)); \ grub_fatal (_("fatal error: %s\n"), _(msg));\
} while (0) } while (0)
#define COPY(str, hint) \ #define COPY(str, hint) \