Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-20 22:48:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

gettext: Integer overflow leads to heap OOB write or read

Browse Source 
Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may
overflow leading to subsequent OOB write or read. This patch fixes the
issue by replacing grub_zalloc() and explicit multiplication with
grub_calloc() which does the same thing in safe manner.

Fixes: CVE-2024-45776

Reported-by: Nils Langius <nils@langius.de>
Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
This commit is contained in:
Lidong Chen authored and Daniel Kiper committed 2025-02-13 15:45:55 +01:00
1 parent 7580addfc8
commit 09bd6eb58b
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/gettext/gettext.c
+2 -2
View File
@@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx,
for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log; for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log;
ctx->grub_gettext_max_log++); ctx->grub_gettext_max_log++);
ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max,
* sizeof (ctx->grub_gettext_msg_list[0])); sizeof (ctx->grub_gettext_msg_list[0]));
if (!ctx->grub_gettext_msg_list) if (!ctx->grub_gettext_msg_list)
{ {
grub_file_close (fd); grub_file_close (fd);