1*4882a593SmuzhiyunFrom 2a330dba93ff11bc00eda76e9419bc52b0c7ead6 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Daniel Axtens <dja@axtens.net> 3*4882a593SmuzhiyunDate: Fri, 22 Jan 2021 16:07:29 +1100 4*4882a593SmuzhiyunSubject: [PATCH] lib/arg: Block repeated short options that require an 5*4882a593Smuzhiyun argument 6*4882a593Smuzhiyun 7*4882a593SmuzhiyunFuzzing found the following crash: 8*4882a593Smuzhiyun 9*4882a593Smuzhiyun search -hhhhhhhhhhhhhf 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunWe didn't allocate enough option space for 13 hints because the 12*4882a593Smuzhiyunallocation code counts the number of discrete arguments (i.e. argc). 13*4882a593SmuzhiyunHowever, the shortopt parsing code will happily keep processing 14*4882a593Smuzhiyuna combination of short options without checking if those short 15*4882a593Smuzhiyunoptions require an argument. This means you can easily end writing 16*4882a593Smuzhiyunpast the allocated option space. 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunThis fixes a OOB write which can cause heap corruption. 19*4882a593Smuzhiyun 20*4882a593SmuzhiyunFixes: CVE-2021-20225 21*4882a593Smuzhiyun 22*4882a593SmuzhiyunReported-by: Daniel Axtens <dja@axtens.net> 23*4882a593SmuzhiyunSigned-off-by: Daniel Axtens <dja@axtens.net> 24*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 25*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 26*4882a593Smuzhiyun--- 27*4882a593Smuzhiyun grub-core/lib/arg.c | 13 +++++++++++++ 28*4882a593Smuzhiyun 1 file changed, 13 insertions(+) 29*4882a593Smuzhiyun 30*4882a593Smuzhiyundiff --git a/grub-core/lib/arg.c b/grub-core/lib/arg.c 31*4882a593Smuzhiyunindex 3288609..537c5e9 100644 32*4882a593Smuzhiyun--- a/grub-core/lib/arg.c 33*4882a593Smuzhiyun+++ b/grub-core/lib/arg.c 34*4882a593Smuzhiyun@@ -299,6 +299,19 @@ grub_arg_parse (grub_extcmd_t cmd, int argc, char **argv, 35*4882a593Smuzhiyun it can have an argument value. */ 36*4882a593Smuzhiyun if (*curshort) 37*4882a593Smuzhiyun { 38*4882a593Smuzhiyun+ /* 39*4882a593Smuzhiyun+ * Only permit further short opts if this one doesn't 40*4882a593Smuzhiyun+ * require a value. 41*4882a593Smuzhiyun+ */ 42*4882a593Smuzhiyun+ if (opt->type != ARG_TYPE_NONE && 43*4882a593Smuzhiyun+ !(opt->flags & GRUB_ARG_OPTION_OPTIONAL)) 44*4882a593Smuzhiyun+ { 45*4882a593Smuzhiyun+ grub_error (GRUB_ERR_BAD_ARGUMENT, 46*4882a593Smuzhiyun+ N_("missing mandatory option for `%s'"), 47*4882a593Smuzhiyun+ opt->longarg); 48*4882a593Smuzhiyun+ goto fail; 49*4882a593Smuzhiyun+ } 50*4882a593Smuzhiyun+ 51*4882a593Smuzhiyun if (parse_option (cmd, opt, 0, usr) || grub_errno) 52*4882a593Smuzhiyun goto fail; 53*4882a593Smuzhiyun } 54*4882a593Smuzhiyun-- 55*4882a593Smuzhiyun2.14.2 56*4882a593Smuzhiyun 57