65c99394ff
Grub 2.06 is affected by a number of CVEs, which have been fixed in the master branch of Grub, but are not yet part of any release (there is a 2.12-rc1 release, but nothing else between 2.06 and 2.12-rc1). So this patch backports the relevant fixes for CVE-2022-28736, CVE-2022-28735, CVE-2021-3695, CVE-2021-3696, CVE-2021-3697, CVE-2022-28733, CVE-2022-28734, CVE-2022-2601 and CVE-2022-3775. It should be noted that CVE-2021-3695, CVE-2021-3696, CVE-2021-3697 are not reported as affecting Grub by our CVE matching logic because the NVD database uses an incorrect CPE ID in those CVEs: it uses "grub" as the product instead of "grub2" like all other CVEs for grub. This issue has been reported to the NVD maintainers. This requires backporting a lot of patches, but jumping from 2.06 to 2.12-rc1 implies getting 592 commits, which is quite a lot. All Grub test cases are working fine: https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500585 https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500679 Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [Arnout: fix check-package warning in patch 0002] Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
84 lines
3.0 KiB
Diff
84 lines
3.0 KiB
Diff
From fefba72d17364d6212cfd3be2232f4ce0ba23b82 Mon Sep 17 00:00:00 2001
|
|
From: Zhang Boyang <zhangboyang.id@gmail.com>
|
|
Date: Fri, 5 Aug 2022 01:58:27 +0800
|
|
Subject: [PATCH] font: Fix several integer overflows in
|
|
grub_font_construct_glyph()
|
|
|
|
This patch fixes several integer overflows in grub_font_construct_glyph().
|
|
Glyphs of invalid size, zero or leading to an overflow, are rejected.
|
|
The inconsistency between "glyph" and "max_glyph_size" when grub_malloc()
|
|
returns NULL is fixed too.
|
|
|
|
Fixes: CVE-2022-2601
|
|
|
|
Reported-by: Zhang Boyang <zhangboyang.id@gmail.com>
|
|
Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
Upstream: 768e1ef2fc159f6e14e7246e4be09363708ac39e
|
|
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
|
|
---
|
|
grub-core/font/font.c | 29 +++++++++++++++++------------
|
|
1 file changed, 17 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/grub-core/font/font.c b/grub-core/font/font.c
|
|
index 876b5b695..0ff552578 100644
|
|
--- a/grub-core/font/font.c
|
|
+++ b/grub-core/font/font.c
|
|
@@ -1515,6 +1515,7 @@ grub_font_construct_glyph (grub_font_t hinted_font,
|
|
struct grub_video_signed_rect bounds;
|
|
static struct grub_font_glyph *glyph = 0;
|
|
static grub_size_t max_glyph_size = 0;
|
|
+ grub_size_t cur_glyph_size;
|
|
|
|
ensure_comb_space (glyph_id);
|
|
|
|
@@ -1531,29 +1532,33 @@ grub_font_construct_glyph (grub_font_t hinted_font,
|
|
if (!glyph_id->ncomb && !glyph_id->attributes)
|
|
return main_glyph;
|
|
|
|
- if (max_glyph_size < sizeof (*glyph) + (bounds.width * bounds.height + GRUB_CHAR_BIT - 1) / GRUB_CHAR_BIT)
|
|
+ if (grub_video_bitmap_calc_1bpp_bufsz (bounds.width, bounds.height, &cur_glyph_size) ||
|
|
+ grub_add (sizeof (*glyph), cur_glyph_size, &cur_glyph_size))
|
|
+ return main_glyph;
|
|
+
|
|
+ if (max_glyph_size < cur_glyph_size)
|
|
{
|
|
grub_free (glyph);
|
|
- max_glyph_size = (sizeof (*glyph) + (bounds.width * bounds.height + GRUB_CHAR_BIT - 1) / GRUB_CHAR_BIT) * 2;
|
|
- if (max_glyph_size < 8)
|
|
- max_glyph_size = 8;
|
|
- glyph = grub_malloc (max_glyph_size);
|
|
+ if (grub_mul (cur_glyph_size, 2, &max_glyph_size))
|
|
+ max_glyph_size = 0;
|
|
+ glyph = max_glyph_size > 0 ? grub_malloc (max_glyph_size) : NULL;
|
|
}
|
|
if (!glyph)
|
|
{
|
|
+ max_glyph_size = 0;
|
|
grub_errno = GRUB_ERR_NONE;
|
|
return main_glyph;
|
|
}
|
|
|
|
- grub_memset (glyph, 0, sizeof (*glyph)
|
|
- + (bounds.width * bounds.height
|
|
- + GRUB_CHAR_BIT - 1) / GRUB_CHAR_BIT);
|
|
+ grub_memset (glyph, 0, cur_glyph_size);
|
|
|
|
glyph->font = main_glyph->font;
|
|
- glyph->width = bounds.width;
|
|
- glyph->height = bounds.height;
|
|
- glyph->offset_x = bounds.x;
|
|
- glyph->offset_y = bounds.y;
|
|
+ if (bounds.width == 0 || bounds.height == 0 ||
|
|
+ grub_cast (bounds.width, &glyph->width) ||
|
|
+ grub_cast (bounds.height, &glyph->height) ||
|
|
+ grub_cast (bounds.x, &glyph->offset_x) ||
|
|
+ grub_cast (bounds.y, &glyph->offset_y))
|
|
+ return main_glyph;
|
|
|
|
if (glyph_id->attributes & GRUB_UNICODE_GLYPH_ATTRIBUTE_MIRROR)
|
|
grub_font_blit_glyph_mirror (glyph, main_glyph,
|
|
--
|
|
2.41.0
|
|
|