vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

efi: Fix some malformed device path arithmetic errors

Browse source 
Several places we take the length of a device path and subtract 4 from
it, without ever checking that it's >= 4. There are also cases where
this kind of malformation will result in unpredictable iteration,
including treating the length from one dp node as the type in the next
node. These are all errors, no matter where the data comes from.

This patch adds a checking macro, GRUB_EFI_DEVICE_PATH_VALID(), which
can be used in several places, and makes GRUB_EFI_NEXT_DEVICE_PATH()
return NULL and GRUB_EFI_END_ENTIRE_DEVICE_PATH() evaluate as true when
the length is too small. Additionally, it makes several places in the
code check for and return errors in these cases.

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Peter Jones 2020-07-19 16:53:27 -04:00 • committed by Daniel Kiper
parent b73cee7f1f
commit d2cf823d0e
4 changed files with 79 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

13
grub-core/loader/efi/chainloader.c
View file

@ -156,9 +156,18 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
size = 0;
d = dp;
while (1)
while (d)
{
size += GRUB_EFI_DEVICE_PATH_LENGTH (d);
grub_size_t len = GRUB_EFI_DEVICE_PATH_LENGTH (d);
if (len < 4)
{
grub_error (GRUB_ERR_OUT_OF_RANGE,
"malformed EFI Device Path node has length=%d", len);
return NULL;
}
size += len;
if ((GRUB_EFI_END_ENTIRE_DEVICE_PATH (d)))
break;
d = GRUB_EFI_NEXT_DEVICE_PATH (d);

9
grub-core/loader/i386/xnu.c
View file

@ -515,14 +515,15 @@ grub_cmd_devprop_load (grub_command_t cmd __attribute__ ((unused)),
devhead = buf;
buf = devhead + 1;
dpstart = buf;
dp = dpstart = buf;
do
while (GRUB_EFI_DEVICE_PATH_VALID (dp) && buf < bufend)
{
dp = buf;
buf = (char *) buf + GRUB_EFI_DEVICE_PATH_LENGTH (dp);
if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp))
break;
dp = buf;
}
while (!GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp) && buf < bufend);
dev = grub_xnu_devprop_add_device (dpstart, (char *) buf
- (char *) dpstart);