Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-21 06:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fs/zfs/zfs: Fix possible insecure use of chunk size in zap_leaf_array_get()

Browse Source 
In zap_leaf_array_get() the chunk size passed in is considered tainted
by Coverity, and is being used before it is tested for validity. To fix
this the assignment of "la" is moved until after the test of the value
of "chunk".

Fixes: CID 314014

Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Darren Kenny authored and Daniel Kiper committed 2021-11-02 16:48:59 +01:00
1 parent b1fae9c1ba
commit bb9ff31641
1 file changed
+2 -1
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/fs/zfs/zfs.c
+2 -1
View File
@@ -2229,7 +2229,7 @@ zap_leaf_array_get (zap_leaf_phys_t * l, grub_zfs_endian_t endian, int blksft,
while (bseen < array_len)
{
struct zap_leaf_array *la = &ZAP_LEAF_CHUNK (l, blksft, chunk)->l_array;
struct zap_leaf_array *la;
grub_size_t toread = array_len - bseen;
if (toread > ZAP_LEAF_ARRAY_BYTES)
@@ -2239,6 +2239,7 @@ zap_leaf_array_get (zap_leaf_phys_t * l, grub_zfs_endian_t endian, int blksft,
/* Don't use grub_error because this error is to be ignored. */
return GRUB_ERR_BAD_FS;
la = &ZAP_LEAF_CHUNK (l, blksft, chunk)->l_array;
grub_memcpy (buf + bseen,la->la_array, toread);
chunk = grub_zfs_to_cpu16 (la->la_next, endian);
bseen += toread;