vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

relocator: Protect grub_relocator_alloc_chunk_addr() input args against integer underflow/overflow

Browse source 
Use arithmetic macros from safemath.h to accomplish it. In this commit,
I didn't want to be too paranoid to check every possible math equation
for overflow/underflow. Only obvious places (with non zero chance of
overflow/underflow) were refactored.

Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Alexey Makhalov 2020-07-15 06:42:37 +00:00 • committed by Daniel Kiper
parent 781b3e5efc
commit caea56d1f8
4 changed files with 31 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

9
grub-core/loader/i386/pc/linux.c
View file

@ -35,6 +35,7 @@
#include <grub/i386/floppy.h>
#include <grub/lib/cmdline.h>
#include <grub/linux.h>
#include <grub/safemath.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -218,8 +219,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
setup_sects = GRUB_LINUX_DEFAULT_SETUP_SECTS;
real_size = setup_sects << GRUB_DISK_SECTOR_BITS;
grub_linux16_prot_size = grub_file_size (file)
- real_size - GRUB_DISK_SECTOR_SIZE;
if (grub_sub (grub_file_size (file), real_size, &grub_linux16_prot_size) ||
grub_sub (grub_linux16_prot_size, GRUB_DISK_SECTOR_SIZE, &grub_linux16_prot_size))
{
grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
goto fail;
}
if (! grub_linux_is_bzimage
&& GRUB_LINUX_ZIMAGE_ADDR + grub_linux16_prot_size