1*4882a593SmuzhiyunFrom 7ce3259f67ac2cd93acb0ec0080c24b3b69e66c6 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Darren Kenny <darren.kenny@oracle.com> 3*4882a593SmuzhiyunDate: Wed, 4 Nov 2020 15:10:51 +0000 4*4882a593SmuzhiyunSubject: [PATCH] video/fb/fbfill: Fix potential integer overflow 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunThe multiplication of 2 unsigned 32-bit integers may overflow before 7*4882a593Smuzhiyunpromotion to unsigned 64-bit. We should ensure that the multiplication 8*4882a593Smuzhiyunis done with overflow detection. Additionally, use grub_sub() for 9*4882a593Smuzhiyunsubtraction. 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunFixes: CID 73640, CID 73697, CID 73702, CID 73823 12*4882a593Smuzhiyun 13*4882a593SmuzhiyunSigned-off-by: Darren Kenny <darren.kenny@oracle.com> 14*4882a593SmuzhiyunSigned-off-by: Marco A Benatto <mbenatto@redhat.com> 15*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 16*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 17*4882a593Smuzhiyun--- 18*4882a593Smuzhiyun grub-core/video/fb/fbfill.c | 17 +++++++++++++---- 19*4882a593Smuzhiyun 1 file changed, 13 insertions(+), 4 deletions(-) 20*4882a593Smuzhiyun 21*4882a593Smuzhiyundiff --git a/grub-core/video/fb/fbfill.c b/grub-core/video/fb/fbfill.c 22*4882a593Smuzhiyunindex 11816d0..a37acd1 100644 23*4882a593Smuzhiyun--- a/grub-core/video/fb/fbfill.c 24*4882a593Smuzhiyun+++ b/grub-core/video/fb/fbfill.c 25*4882a593Smuzhiyun@@ -31,6 +31,7 @@ 26*4882a593Smuzhiyun #include <grub/fbfill.h> 27*4882a593Smuzhiyun #include <grub/fbutil.h> 28*4882a593Smuzhiyun #include <grub/types.h> 29*4882a593Smuzhiyun+#include <grub/safemath.h> 30*4882a593Smuzhiyun #include <grub/video.h> 31*4882a593Smuzhiyun 32*4882a593Smuzhiyun /* Generic filler that works for every supported mode. */ 33*4882a593Smuzhiyun@@ -61,7 +62,9 @@ grub_video_fbfill_direct32 (struct grub_video_fbblit_info *dst, 34*4882a593Smuzhiyun 35*4882a593Smuzhiyun /* Calculate the number of bytes to advance from the end of one line 36*4882a593Smuzhiyun to the beginning of the next line. */ 37*4882a593Smuzhiyun- rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width; 38*4882a593Smuzhiyun+ if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) || 39*4882a593Smuzhiyun+ grub_sub (dst->mode_info->pitch, rowskip, &rowskip)) 40*4882a593Smuzhiyun+ return; 41*4882a593Smuzhiyun 42*4882a593Smuzhiyun /* Get the start address. */ 43*4882a593Smuzhiyun dstptr = grub_video_fb_get_video_ptr (dst, x, y); 44*4882a593Smuzhiyun@@ -98,7 +101,9 @@ grub_video_fbfill_direct24 (struct grub_video_fbblit_info *dst, 45*4882a593Smuzhiyun #endif 46*4882a593Smuzhiyun /* Calculate the number of bytes to advance from the end of one line 47*4882a593Smuzhiyun to the beginning of the next line. */ 48*4882a593Smuzhiyun- rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width; 49*4882a593Smuzhiyun+ if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) || 50*4882a593Smuzhiyun+ grub_sub (dst->mode_info->pitch, rowskip, &rowskip)) 51*4882a593Smuzhiyun+ return; 52*4882a593Smuzhiyun 53*4882a593Smuzhiyun /* Get the start address. */ 54*4882a593Smuzhiyun dstptr = grub_video_fb_get_video_ptr (dst, x, y); 55*4882a593Smuzhiyun@@ -131,7 +136,9 @@ grub_video_fbfill_direct16 (struct grub_video_fbblit_info *dst, 56*4882a593Smuzhiyun 57*4882a593Smuzhiyun /* Calculate the number of bytes to advance from the end of one line 58*4882a593Smuzhiyun to the beginning of the next line. */ 59*4882a593Smuzhiyun- rowskip = (dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width); 60*4882a593Smuzhiyun+ if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) || 61*4882a593Smuzhiyun+ grub_sub (dst->mode_info->pitch, rowskip, &rowskip)) 62*4882a593Smuzhiyun+ return; 63*4882a593Smuzhiyun 64*4882a593Smuzhiyun /* Get the start address. */ 65*4882a593Smuzhiyun dstptr = grub_video_fb_get_video_ptr (dst, x, y); 66*4882a593Smuzhiyun@@ -161,7 +168,9 @@ grub_video_fbfill_direct8 (struct grub_video_fbblit_info *dst, 67*4882a593Smuzhiyun 68*4882a593Smuzhiyun /* Calculate the number of bytes to advance from the end of one line 69*4882a593Smuzhiyun to the beginning of the next line. */ 70*4882a593Smuzhiyun- rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width; 71*4882a593Smuzhiyun+ if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) || 72*4882a593Smuzhiyun+ grub_sub (dst->mode_info->pitch, rowskip, &rowskip)) 73*4882a593Smuzhiyun+ return; 74*4882a593Smuzhiyun 75*4882a593Smuzhiyun /* Get the start address. */ 76*4882a593Smuzhiyun dstptr = grub_video_fb_get_video_ptr (dst, x, y); 77*4882a593Smuzhiyun-- 78*4882a593Smuzhiyun2.14.2 79*4882a593Smuzhiyun 80