1*4882a593SmuzhiyunFrom e8814c811132a70f9b55418f7567378a34ad3883 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Darren Kenny <darren.kenny@oracle.com> 3*4882a593SmuzhiyunDate: Tue, 3 Nov 2020 16:43:37 +0000 4*4882a593SmuzhiyunSubject: [PATCH] libgcrypt/mpi: Fix possible unintended sign extension 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunThe array of unsigned char gets promoted to a signed 32-bit int before 7*4882a593Smuzhiyunit is finally promoted to a size_t. There is the possibility that this 8*4882a593Smuzhiyunmay result in the signed-bit being set for the intermediate signed 9*4882a593Smuzhiyun32-bit int. We should ensure that the promotion is to the correct type 10*4882a593Smuzhiyunbefore we bitwise-OR the values. 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunFixes: CID 96697 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunSigned-off-by: Darren Kenny <darren.kenny@oracle.com> 15*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 16*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 17*4882a593Smuzhiyun--- 18*4882a593Smuzhiyun grub-core/lib/libgcrypt-grub/mpi/mpicoder.c | 2 +- 19*4882a593Smuzhiyun grub-core/lib/libgcrypt/mpi/mpicoder.c | 2 +- 20*4882a593Smuzhiyun 2 files changed, 2 insertions(+), 2 deletions(-) 21*4882a593Smuzhiyun 22*4882a593Smuzhiyundiff --git a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 23*4882a593Smuzhiyunindex 3d55dfc..faf1cd6 100644 24*4882a593Smuzhiyun--- a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 25*4882a593Smuzhiyun+++ b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 26*4882a593Smuzhiyun@@ -460,7 +460,7 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, 27*4882a593Smuzhiyun if (len && len < 4) 28*4882a593Smuzhiyun return gcry_error (GPG_ERR_TOO_SHORT); 29*4882a593Smuzhiyun 30*4882a593Smuzhiyun- n = (s[0] << 24 | s[1] << 16 | s[2] << 8 | s[3]); 31*4882a593Smuzhiyun+ n = ((size_t)s[0] << 24 | (size_t)s[1] << 16 | (size_t)s[2] << 8 | (size_t)s[3]); 32*4882a593Smuzhiyun s += 4; 33*4882a593Smuzhiyun if (len) 34*4882a593Smuzhiyun len -= 4; 35*4882a593Smuzhiyundiff --git a/grub-core/lib/libgcrypt/mpi/mpicoder.c b/grub-core/lib/libgcrypt/mpi/mpicoder.c 36*4882a593Smuzhiyunindex a3435ed..7ecad27 100644 37*4882a593Smuzhiyun--- a/grub-core/lib/libgcrypt/mpi/mpicoder.c 38*4882a593Smuzhiyun+++ b/grub-core/lib/libgcrypt/mpi/mpicoder.c 39*4882a593Smuzhiyun@@ -458,7 +458,7 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, 40*4882a593Smuzhiyun if (len && len < 4) 41*4882a593Smuzhiyun return gcry_error (GPG_ERR_TOO_SHORT); 42*4882a593Smuzhiyun 43*4882a593Smuzhiyun- n = (s[0] << 24 | s[1] << 16 | s[2] << 8 | s[3]); 44*4882a593Smuzhiyun+ n = ((size_t)s[0] << 24 | (size_t)s[1] << 16 | (size_t)s[2] << 8 | (size_t)s[3]); 45*4882a593Smuzhiyun s += 4; 46*4882a593Smuzhiyun if (len) 47*4882a593Smuzhiyun len -= 4; 48*4882a593Smuzhiyun-- 49*4882a593Smuzhiyun2.14.2 50*4882a593Smuzhiyun 51