1*4882a593SmuzhiyunFrom 08413f2f4edec0e2d9bf15f836f6ee5ca2e379cb Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Darren Kenny <darren.kenny@oracle.com> 3*4882a593SmuzhiyunDate: Fri, 4 Dec 2020 14:51:30 +0000 4*4882a593SmuzhiyunSubject: [PATCH] video/fb/video_fb: Fix possible integer overflow 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunIt is minimal possibility that the values being used here will overflow. 7*4882a593SmuzhiyunSo, change the code to use the safemath function grub_mul() to ensure 8*4882a593Smuzhiyunthat doesn't happen. 9*4882a593Smuzhiyun 10*4882a593SmuzhiyunFixes: CID 73761 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunSigned-off-by: Darren Kenny <darren.kenny@oracle.com> 13*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 14*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 15*4882a593Smuzhiyun--- 16*4882a593Smuzhiyun grub-core/video/fb/video_fb.c | 8 +++++++- 17*4882a593Smuzhiyun 1 file changed, 7 insertions(+), 1 deletion(-) 18*4882a593Smuzhiyun 19*4882a593Smuzhiyundiff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c 20*4882a593Smuzhiyunindex 1c9a138..ae6b89f 100644 21*4882a593Smuzhiyun--- a/grub-core/video/fb/video_fb.c 22*4882a593Smuzhiyun+++ b/grub-core/video/fb/video_fb.c 23*4882a593Smuzhiyun@@ -1537,7 +1537,13 @@ doublebuf_pageflipping_init (struct grub_video_mode_info *mode_info, 24*4882a593Smuzhiyun volatile void *page1_ptr) 25*4882a593Smuzhiyun { 26*4882a593Smuzhiyun grub_err_t err; 27*4882a593Smuzhiyun- grub_size_t page_size = mode_info->pitch * mode_info->height; 28*4882a593Smuzhiyun+ grub_size_t page_size = 0; 29*4882a593Smuzhiyun+ 30*4882a593Smuzhiyun+ if (grub_mul (mode_info->pitch, mode_info->height, &page_size)) 31*4882a593Smuzhiyun+ { 32*4882a593Smuzhiyun+ /* Shouldn't happen, but if it does we've a bug. */ 33*4882a593Smuzhiyun+ return GRUB_ERR_BUG; 34*4882a593Smuzhiyun+ } 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun framebuffer.offscreen_buffer = grub_malloc (page_size); 37*4882a593Smuzhiyun if (! framebuffer.offscreen_buffer) 38*4882a593Smuzhiyun-- 39*4882a593Smuzhiyun2.14.2 40*4882a593Smuzhiyun 41