1From fb55bc37dd510911df4eaf649da939f5fafdc7ce Mon Sep 17 00:00:00 2001
2From: Daniel Kiper <daniel.kiper@oracle.com>
3Date: Wed, 29 Jul 2020 13:38:31 +0200
4Subject: [PATCH] efi/chainloader: Propagate errors from copy_file_path()
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9Without any error propagated to the caller, make_file_path()
10would then try to advance the invalid device path node with
11GRUB_EFI_NEXT_DEVICE_PATH(), which would fail, returning a NULL
12pointer that would subsequently be dereferenced. Hence, propagate
13errors from copy_file_path().
14
15Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
18---
19 grub-core/loader/efi/chainloader.c | 19 +++++++++++++------
20 1 file changed, 13 insertions(+), 6 deletions(-)
21
22diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
23index a8d7b9155..7b31c3fb9 100644
24--- a/grub-core/loader/efi/chainloader.c
25+++ b/grub-core/loader/efi/chainloader.c
26@@ -106,7 +106,7 @@ grub_chainloader_boot (void)
27   return grub_errno;
28 }
29
30-static void
31+static grub_err_t
32 copy_file_path (grub_efi_file_path_device_path_t *fp,
33 		const char *str, grub_efi_uint16_t len)
34 {
35@@ -118,7 +118,7 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
36
37   path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name));
38   if (!path_name)
39-    return;
40+    return grub_error (GRUB_ERR_OUT_OF_MEMORY, "failed to allocate path buffer");
41
42   size = grub_utf8_to_utf16 (path_name, len * GRUB_MAX_UTF16_PER_UTF8,
43 			     (const grub_uint8_t *) str, len, 0);
44@@ -131,6 +131,7 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
45   fp->path_name[size++] = '\0';
46   fp->header.length = size * sizeof (grub_efi_char16_t) + sizeof (*fp);
47   grub_free (path_name);
48+  return GRUB_ERR_NONE;
49 }
50
51 static grub_efi_device_path_t *
52@@ -189,13 +190,19 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
53   d = (grub_efi_device_path_t *) ((char *) file_path
54 				  + ((char *) d - (char *) dp));
55   grub_efi_print_device_path (d);
56-  copy_file_path ((grub_efi_file_path_device_path_t *) d,
57-		  dir_start, dir_end - dir_start);
58+  if (copy_file_path ((grub_efi_file_path_device_path_t *) d,
59+		      dir_start, dir_end - dir_start) != GRUB_ERR_NONE)
60+    {
61+ fail:
62+      grub_free (file_path);
63+      return 0;
64+    }
65
66   /* Fill the file path for the file.  */
67   d = GRUB_EFI_NEXT_DEVICE_PATH (d);
68-  copy_file_path ((grub_efi_file_path_device_path_t *) d,
69-		  dir_end + 1, grub_strlen (dir_end + 1));
70+  if (copy_file_path ((grub_efi_file_path_device_path_t *) d,
71+		      dir_end + 1, grub_strlen (dir_end + 1)) != GRUB_ERR_NONE)
72+    goto fail;
73
74   /* Fill the end of device path nodes.  */
75   d = GRUB_EFI_NEXT_DEVICE_PATH (d);
76--
772.26.2
78
79