grub/grub-core/kern/fs.c
Peter Jones f725fa7cb2 calloc: Use calloc() at most places
This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
2020-07-29 16:55:47 +02:00

251 lines
5.7 KiB
C
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

/* fs.c - filesystem manager */
/*
* GRUB -- GRand Unified Bootloader
* Copyright (C) 2002,2005,2007 Free Software Foundation, Inc.
*
* GRUB is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* GRUB is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
*/
#include <grub/disk.h>
#include <grub/net.h>
#include <grub/fs.h>
#include <grub/file.h>
#include <grub/err.h>
#include <grub/misc.h>
#include <grub/types.h>
#include <grub/mm.h>
#include <grub/term.h>
#include <grub/i18n.h>
grub_fs_t grub_fs_list = 0;
grub_fs_autoload_hook_t grub_fs_autoload_hook = 0;
/* Helper for grub_fs_probe. */
static int
probe_dummy_iter (const char *filename __attribute__ ((unused)),
const struct grub_dirhook_info *info __attribute__ ((unused)),
void *data __attribute__ ((unused)))
{
return 1;
}
grub_fs_t
grub_fs_probe (grub_device_t device)
{
grub_fs_t p;
if (device->disk)
{
/* Make it sure not to have an infinite recursive calls. */
static int count = 0;
for (p = grub_fs_list; p; p = p->next)
{
grub_dprintf ("fs", "Detecting %s...\n", p->name);
/* This is evil: newly-created just mounted BtrFS after copying all
GRUB files has a very peculiar unrecoverable corruption which
will be fixed at sync but we'd rather not do a global sync and
syncing just files doesn't seem to help. Relax the check for
this time. */
#ifdef GRUB_UTIL
if (grub_strcmp (p->name, "btrfs") == 0)
{
char *label = 0;
p->fs_uuid (device, &label);
if (label)
grub_free (label);
}
else
#endif
(p->fs_dir) (device, "/", probe_dummy_iter, NULL);
if (grub_errno == GRUB_ERR_NONE)
return p;
grub_error_push ();
grub_dprintf ("fs", "%s detection failed.\n", p->name);
grub_error_pop ();
if (grub_errno != GRUB_ERR_BAD_FS
&& grub_errno != GRUB_ERR_OUT_OF_RANGE)
return 0;
grub_errno = GRUB_ERR_NONE;
}
/* Let's load modules automatically. */
if (grub_fs_autoload_hook && count == 0)
{
count++;
while (grub_fs_autoload_hook ())
{
p = grub_fs_list;
(p->fs_dir) (device, "/", probe_dummy_iter, NULL);
if (grub_errno == GRUB_ERR_NONE)
{
count--;
return p;
}
if (grub_errno != GRUB_ERR_BAD_FS
&& grub_errno != GRUB_ERR_OUT_OF_RANGE)
{
count--;
return 0;
}
grub_errno = GRUB_ERR_NONE;
}
count--;
}
}
else if (device->net && device->net->fs)
return device->net->fs;
grub_error (GRUB_ERR_UNKNOWN_FS, N_("unknown filesystem"));
return 0;
}
/* Block list support routines. */
struct grub_fs_block
{
grub_disk_addr_t offset;
unsigned long length;
};
static grub_err_t
grub_fs_blocklist_open (grub_file_t file, const char *name)
{
const char *p = name;
unsigned num = 0;
unsigned i;
grub_disk_t disk = file->device->disk;
struct grub_fs_block *blocks;
/* First, count the number of blocks. */
do
{
num++;
p = grub_strchr (p, ',');
if (p)
p++;
}
while (p);
/* Allocate a block list. */
blocks = grub_calloc (num + 1, sizeof (struct grub_fs_block));
if (! blocks)
return 0;
file->size = 0;
p = (char *) name;
for (i = 0; i < num; i++)
{
if (*p != '+')
{
blocks[i].offset = grub_strtoull (p, &p, 0);
if (grub_errno != GRUB_ERR_NONE || *p != '+')
{
grub_error (GRUB_ERR_BAD_FILENAME,
N_("invalid file name `%s'"), name);
goto fail;
}
}
p++;
blocks[i].length = grub_strtoul (p, &p, 0);
if (grub_errno != GRUB_ERR_NONE
|| blocks[i].length == 0
|| (*p && *p != ',' && ! grub_isspace (*p)))
{
grub_error (GRUB_ERR_BAD_FILENAME,
N_("invalid file name `%s'"), name);
goto fail;
}
if (disk->total_sectors < blocks[i].offset + blocks[i].length)
{
grub_error (GRUB_ERR_BAD_FILENAME, "beyond the total sectors");
goto fail;
}
file->size += (blocks[i].length << GRUB_DISK_SECTOR_BITS);
p++;
}
file->data = blocks;
return GRUB_ERR_NONE;
fail:
grub_free (blocks);
return grub_errno;
}
static grub_ssize_t
grub_fs_blocklist_read (grub_file_t file, char *buf, grub_size_t len)
{
struct grub_fs_block *p;
grub_disk_addr_t sector;
grub_off_t offset;
grub_ssize_t ret = 0;
if (len > file->size - file->offset)
len = file->size - file->offset;
sector = (file->offset >> GRUB_DISK_SECTOR_BITS);
offset = (file->offset & (GRUB_DISK_SECTOR_SIZE - 1));
for (p = file->data; p->length && len > 0; p++)
{
if (sector < p->length)
{
grub_size_t size;
size = len;
if (((size + offset + GRUB_DISK_SECTOR_SIZE - 1)
>> GRUB_DISK_SECTOR_BITS) > p->length - sector)
size = ((p->length - sector) << GRUB_DISK_SECTOR_BITS) - offset;
if (grub_disk_read (file->device->disk, p->offset + sector, offset,
size, buf) != GRUB_ERR_NONE)
return -1;
ret += size;
len -= size;
sector -= ((size + offset) >> GRUB_DISK_SECTOR_BITS);
offset = ((size + offset) & (GRUB_DISK_SECTOR_SIZE - 1));
}
else
sector -= p->length;
}
return ret;
}
struct grub_fs grub_fs_blocklist =
{
.name = "blocklist",
.fs_dir = 0,
.fs_open = grub_fs_blocklist_open,
.fs_read = grub_fs_blocklist_read,
.fs_close = 0,
.next = 0
};