Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-26 00:59:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fs: Prevent overflows when allocating memory for arrays

Browse Source 
Use grub_calloc() when allocating memory for arrays to ensure proper
overflow checks are in place.

The HFS+ and squash4 security vulnerabilities were reported by
Jonathan Bar Or <jonathanbaror@gmail.com>.

Fixes: CVE-2025-0678
Fixes: CVE-2025-1125

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen authored and Daniel Kiper committed 2025-02-13 15:45:57 +01:00
1 parent 6608163b08
commit 84bc0a9a68
3 files changed
+13 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/fs/hfspluscomp.c
+7 -2
View File
@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node)
return 0;
}
node->compress_index_size = grub_le_to_cpu32 (index_size);
node->compress_index = grub_malloc (node->compress_index_size
* sizeof (node->compress_index[0]));
node->compress_index = grub_calloc (node->compress_index_size,
sizeof (node->compress_index[0]));
if (!node->compress_index)
{
node->compressed = 0;
grub_free (attr_node);
return grub_errno;
}
/*
* The node->compress_index_size * sizeof (node->compress_index[0]) is safe here
* due to relevant checks done in grub_calloc() above.
*/
if (grub_hfsplus_read_file (node, 0, 0,
0x104 + sizeof (index_size),
node->compress_index_size