grub/grub-core/term
Konrad Rzeszutek Wilk 61b7ca08d1 term: Fix overflow on user inputs
This requires a very weird input from the serial interface but can cause
an overflow in input_buf (keys) overwriting the next variable (npending)
with the user choice:

(pahole output)

struct grub_terminfo_input_state {
        int                        input_buf[6];         /*     0    24 */
        int                        npending;             /*    24     4 */ <- CORRUPT
        ...snip...

The magic string requires causing this is "ESC,O,],0,1,2,q" and we overflow
npending with "q" (aka increase npending to 161). The simplest fix is to
just to disallow overwrites input_buf, which exactly what this patch does.

Fixes: CID 292449

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
2020-07-29 16:55:48 +02:00
..
arc * grub-core/term/arc/console.c: Add missing cast to silence warning. 2013-11-24 05:05:34 +01:00
arm arm_coreboot: Add Chromebook keyboard driver. 2017-05-09 08:47:34 +02:00
efi efi/console: Do not set text-mode until we actually need it 2020-04-21 22:13:14 +02:00
i386 core: use GRUB_TERM_ definitions when handling term characters 2017-08-07 19:28:22 +02:00
ieee1275 * grub-core/term/ieee1275/escc.c (GRUB_MOD_INIT): Fix order of channels. 2013-11-10 17:53:11 +01:00
uboot Add progress module to display load progress of files. 2013-10-22 16:42:20 -02:00
xen Remove xen VFB. 2013-12-18 18:43:09 +01:00
at_keyboard.c at_keyboard: Fix unreliable key presses 2019-10-21 14:07:47 +02:00
gfxterm.c gfxterm: Fix clearing of cursor. 2017-01-31 18:49:37 +01:00
gfxterm_background.c Detach optional parts of gfxterm and integrate in with coreboot init. 2013-05-31 00:42:33 +02:00
morse.c Add progress module to display load progress of files. 2013-10-22 16:42:20 -02:00
ns8250.c Avoid division by zero in serial. 2015-01-21 17:42:13 +01:00
ps2.c at_keyboard: Split protocol from controller code. 2017-05-08 21:41:22 +02:00
serial.c misc: Make grub_strtol() "end" pointers have safer const qualifiers 2020-02-28 12:41:29 +01:00
spkmodem.c Add progress module to display load progress of files. 2013-10-22 16:42:20 -02:00
terminfo.c term: Fix overflow on user inputs 2020-07-29 16:55:48 +02:00
tparm.c Enable -Wformat=2 if it's supported. 2013-12-21 15:28:28 +01:00
usb_keyboard.c usb_keyboard: Remove useless include 2016-02-22 20:05:54 +01:00