1*4882a593SmuzhiyunFrom 73bc7a964c9496d5b0f00dbd69959dacf5adcebe Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Daniel Kiper <daniel.kiper@oracle.com> 3*4882a593SmuzhiyunDate: Tue, 7 Jul 2020 15:36:26 +0200 4*4882a593SmuzhiyunSubject: [PATCH] font: Do not load more than one NAME section 5*4882a593SmuzhiyunMIME-Version: 1.0 6*4882a593SmuzhiyunContent-Type: text/plain; charset=UTF-8 7*4882a593SmuzhiyunContent-Transfer-Encoding: 8bit 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunThe GRUB font file can have one NAME section only. Though if somebody 10*4882a593Smuzhiyuncrafts a broken font file with many NAME sections and loads it then the 11*4882a593SmuzhiyunGRUB leaks memory. So, prevent against that by loading first NAME 12*4882a593Smuzhiyunsection and failing in controlled way on following one. 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunReported-by: Chris Coulson <chris.coulson@canonical.com> 15*4882a593SmuzhiyunSigned-off-by: Daniel Kiper <daniel.kiper@oracle.com> 16*4882a593SmuzhiyunReviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com> 17*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 18*4882a593Smuzhiyun--- 19*4882a593Smuzhiyun grub-core/font/font.c | 6 ++++++ 20*4882a593Smuzhiyun 1 file changed, 6 insertions(+) 21*4882a593Smuzhiyun 22*4882a593Smuzhiyundiff --git a/grub-core/font/font.c b/grub-core/font/font.c 23*4882a593Smuzhiyunindex 5edb477ac..d09bb38d8 100644 24*4882a593Smuzhiyun--- a/grub-core/font/font.c 25*4882a593Smuzhiyun+++ b/grub-core/font/font.c 26*4882a593Smuzhiyun@@ -532,6 +532,12 @@ grub_font_load (const char *filename) 27*4882a593Smuzhiyun if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME, 28*4882a593Smuzhiyun sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0) 29*4882a593Smuzhiyun { 30*4882a593Smuzhiyun+ if (font->name != NULL) 31*4882a593Smuzhiyun+ { 32*4882a593Smuzhiyun+ grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections"); 33*4882a593Smuzhiyun+ goto fail; 34*4882a593Smuzhiyun+ } 35*4882a593Smuzhiyun+ 36*4882a593Smuzhiyun font->name = read_section_as_string (§ion); 37*4882a593Smuzhiyun if (!font->name) 38*4882a593Smuzhiyun goto fail; 39*4882a593Smuzhiyun-- 40*4882a593Smuzhiyun2.26.2 41*4882a593Smuzhiyun 42