mirror of
https://git.savannah.gnu.org/git/grub.git
synced 2026-10-23 23:59:22 +00:00
kern/efi/mm: Fix possible NULL pointer dereference
The model of grub_efi_get_memory_map() is that if memory_map is NULL, then the purpose is to discover how much memory should be allocated to it for the subsequent call. The problem here is that with grub_efi_is_finished set to 1, there is no check at all that the function is being called with a non-NULL memory_map. While this MAY be true, we shouldn't assume it. The solution to this is to behave as expected, and if memory_map is NULL, then don't try to use it and allow memory_map_size to be filled in, and return 0 as is done later in the code if the buffer is too small (or NULL). Additionally, drop unneeded ret = 1. Fixes: CID 96632 Signed-off-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
1 parent
ed286ceba6
commit
6aee4bfd69
1 file changed
+14
-5
+14
-5
@@ -339,15 +339,24 @@ grub_efi_get_memory_map (grub_efi_uintn_t *memory_map_size,
|
|||||||
if (grub_efi_is_finished)
|
if (grub_efi_is_finished)
|
||||||
{
|
{
|
||||||
int ret = 1;
|
int ret = 1;
|
||||||
if (*memory_map_size < finish_mmap_size)
|
|
||||||
|
if (memory_map != NULL)
|
||||||
{
|
{
|
||||||
grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size);
|
if (*memory_map_size < finish_mmap_size)
|
||||||
ret = 0;
|
{
|
||||||
|
grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size);
|
||||||
|
ret = 0;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size);
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size);
|
/*
|
||||||
ret = 1;
|
* Incomplete, no buffer to copy into, same as
|
||||||
|
* GRUB_EFI_BUFFER_TOO_SMALL below.
|
||||||
|
*/
|
||||||
|
ret = 0;
|
||||||
}
|
}
|
||||||
*memory_map_size = finish_mmap_size;
|
*memory_map_size = finish_mmap_size;
|
||||||
if (map_key)
|
if (map_key)
|
||||||
|
|||||||
Reference in new issue
Block a user