From a8cc95de74ccc3ad090e8062ac335c844f13c9f4 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Thu, 21 Jan 2021 17:59:14 +1100 Subject: [PATCH] disk/lvm: Don't go beyond the end of the data we read from disk We unconditionally trusted offset_xl from the LVM label header, even if it told us that the PV header/disk locations were way off past the end of the data we read from disk. Require that the offset be sane, fixing an OOB read and crash. Fixes: CID 314367, CID 314371 Signed-off-by: Daniel Axtens Reviewed-by: Daniel Kiper Signed-off-by: Stefan Sørensen --- grub-core/disk/lvm.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c index 139fafd..8136122 100644 --- a/grub-core/disk/lvm.c +++ b/grub-core/disk/lvm.c @@ -141,6 +141,20 @@ grub_lvm_detect (grub_disk_t disk, goto fail; } + /* + * We read a grub_lvm_pv_header and then 2 grub_lvm_disk_locns that + * immediately follow the PV header. Make sure we have space for both. + */ + if (grub_le_to_cpu32 (lh->offset_xl) >= + GRUB_LVM_LABEL_SIZE - sizeof (struct grub_lvm_pv_header) - + 2 * sizeof (struct grub_lvm_disk_locn)) + { +#ifdef GRUB_UTIL + grub_util_info ("LVM PV header/disk locations are beyond the end of the block"); +#endif + goto fail; + } + pvh = (struct grub_lvm_pv_header *) (buf + grub_le_to_cpu32(lh->offset_xl)); for (i = 0, j = 0; i < GRUB_LVM_ID_LEN; i++) -- 2.14.2