Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-26 09:10:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fs: Prevent overflows when assigning returned values from read_number()

Browse Source 
The direct assignment of the unsigned long long value returned by
read_number() can potentially lead to an overflow on a 32-bit systems.
The fix replaces the direct assignments with calls to grub_cast()
which detects the overflows and safely assigns the values if no
overflow is detected.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen authored and Daniel Kiper committed 2025-02-13 15:45:57 +01:00
1 parent 84bc0a9a68
commit cde9f7f338
2 files changed
+30 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/fs/cpio_common.c
+14 -4
View File
@@ -62,11 +62,21 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
#endif
)
return grub_error (GRUB_ERR_BAD_FS, "invalid cpio archive");
data->size = read_number (hd.filesize, ARRAY_SIZE (hd.filesize));
if (grub_cast (read_number (hd.filesize, ARRAY_SIZE (hd.filesize)), &data->size))
return grub_error (GRUB_ERR_BAD_FS, N_("data size overflow"));
if (mtime)
*mtime = read_number (hd.mtime, ARRAY_SIZE (hd.mtime));
modeval = read_number (hd.mode, ARRAY_SIZE (hd.mode));
namesize = read_number (hd.namesize, ARRAY_SIZE (hd.namesize));
{
if (grub_cast (read_number (hd.mtime, ARRAY_SIZE (hd.mtime)), mtime))
return grub_error (GRUB_ERR_BAD_FS, N_("mtime overflow"));
}
if (grub_cast (read_number (hd.mode, ARRAY_SIZE (hd.mode)), &modeval))
return grub_error (GRUB_ERR_BAD_FS, N_("mode overflow"));
if (grub_cast (read_number (hd.namesize, ARRAY_SIZE (hd.namesize)), &namesize))
return grub_error (GRUB_ERR_BAD_FS, N_("namesize overflow"));
/* Don't allow negative numbers. */
if (namesize >= 0x80000000)