grub/grub-core/kern/efi
Peter Jones d2cf823d0e efi: Fix some malformed device path arithmetic errors
Several places we take the length of a device path and subtract 4 from
it, without ever checking that it's >= 4. There are also cases where
this kind of malformation will result in unpredictable iteration,
including treating the length from one dp node as the type in the next
node. These are all errors, no matter where the data comes from.

This patch adds a checking macro, GRUB_EFI_DEVICE_PATH_VALID(), which
can be used in several places, and makes GRUB_EFI_NEXT_DEVICE_PATH()
return NULL and GRUB_EFI_END_ENTIRE_DEVICE_PATH() evaluate as true when
the length is too small. Additionally, it makes several places in the
code check for and return errors in these cases.

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
2020-07-29 16:55:48 +02:00
..
acpi.c tsc: Use alternative delay sources whenever appropriate. 2015-11-27 11:39:55 +01:00
efi.c efi: Fix some malformed device path arithmetic errors 2020-07-29 16:55:48 +02:00
fdt.c efi: Move fdt helper into own file 2016-11-24 10:09:24 +01:00
init.c efi: Free malloc regions on exit 2017-09-07 23:35:01 +02:00
mm.c efi: Print error messages to grub_efi_allocate_pages_real() 2020-03-10 21:41:16 +01:00