1From a7ab0cc98fa89a3d5098c29cbe44bcd24b0a6454 Mon Sep 17 00:00:00 2001
2From: Peter Jones <pjones@redhat.com>
3Date: Wed, 15 Apr 2020 15:45:02 -0400
4Subject: [PATCH] yylex: Make lexer fatal errors actually be fatal
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9When presented with a command that can't be tokenized to anything
10smaller than YYLMAX characters, the parser calls YY_FATAL_ERROR(errmsg),
11expecting that will stop further processing, as such:
12
13  #define YY_DO_BEFORE_ACTION \
14        yyg->yytext_ptr = yy_bp; \
15        yyleng = (int) (yy_cp - yy_bp); \
16        yyg->yy_hold_char = *yy_cp; \
17        *yy_cp = '\0'; \
18        if ( yyleng >= YYLMAX ) \
19                YY_FATAL_ERROR( "token too large, exceeds YYLMAX" ); \
20        yy_flex_strncpy( yytext, yyg->yytext_ptr, yyleng + 1 , yyscanner); \
21        yyg->yy_c_buf_p = yy_cp;
22
23The code flex generates expects that YY_FATAL_ERROR() will either return
24for it or do some form of longjmp(), or handle the error in some way at
25least, and so the strncpy() call isn't in an "else" clause, and thus if
26YY_FATAL_ERROR() is *not* actually fatal, it does the call with the
27questionable limit, and predictable results ensue.
28
29Unfortunately, our implementation of YY_FATAL_ERROR() is:
30
31   #define YY_FATAL_ERROR(msg)                     \
32     do {                                          \
33       grub_printf (_("fatal error: %s\n"), _(msg));     \
34     } while (0)
35
36The same pattern exists in yyless(), and similar problems exist in users
37of YY_INPUT(), several places in the main parsing loop,
38yy_get_next_buffer(), yy_load_buffer_state(), yyensure_buffer_stack,
39yy_scan_buffer(), etc.
40
41All of these callers expect YY_FATAL_ERROR() to actually be fatal, and
42the things they do if it returns after calling it are wildly unsafe.
43
44Fixes: CVE-2020-10713
45
46Signed-off-by: Peter Jones <pjones@redhat.com>
47Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
48Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
49---
50 grub-core/script/yylex.l | 4 ++--
51 1 file changed, 2 insertions(+), 2 deletions(-)
52
53diff --git a/grub-core/script/yylex.l b/grub-core/script/yylex.l
54index 7b44c37b7..b7203c823 100644
55--- a/grub-core/script/yylex.l
56+++ b/grub-core/script/yylex.l
57@@ -37,11 +37,11 @@
58
59 /*
60  * As we don't have access to yyscanner, we cannot do much except to
61- * print the fatal error.
62+ * print the fatal error and exit.
63  */
64 #define YY_FATAL_ERROR(msg)                     \
65   do {                                          \
66-    grub_printf (_("fatal error: %s\n"), _(msg));     \
67+    grub_fatal (_("fatal error: %s\n"), _(msg));\
68   } while (0)
69
70 #define COPY(str, hint)                         \
71--
722.26.2
73
74