B Horn 500e5fdd82 kern/dl: Fix for an integer overflow in grub_dl_ref() ...

It was possible to overflow the value of mod->ref_count, a signed
integer, by repeatedly invoking insmod on an already loaded module.
This led to a use-after-free. As once ref_count was overflowed it became
possible to unload the module while there was still references to it.

This resolves the issue by using grub_add() to check if the ref_count
will overflow and then stops further increments. Further changes were
also made to grub_dl_unref() to check for the underflow condition and
the reference count was changed to an unsigned 64-bit integer.

Reported-by: B Horn <b@horn.uk>
Signed-off-by: B Horn <b@horn.uk>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-02-13 15:45:55 +01:00

..

grub

kern/dl: Fix for an integer overflow in grub_dl_ref()

2025-02-13 15:45:55 +01:00

xen

include: Remove trailing whitespaces

2022-03-14 16:01:26 +01:00

multiboot2.h

include: Remove trailing whitespaces

2022-03-14 16:01:26 +01:00

multiboot.h

Add gcc_struct to all packed structures when compiling with mingw.

2013-12-15 14:14:30 +01:00