1*4882a593SmuzhiyunFrom 2f533a89a8dfcacbf2c9dbc77d910f111f24bf33 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Daniel Axtens <dja@axtens.net> 3*4882a593SmuzhiyunDate: Fri, 22 Jan 2021 17:10:48 +1100 4*4882a593SmuzhiyunSubject: [PATCH] commands/menuentry: Fix quoting in setparams_prefix() 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunCommit 9acdcbf32542 (use single quotes in menuentry setparams command) 7*4882a593Smuzhiyunsays that expressing a quoted single quote will require 3 characters. It 8*4882a593Smuzhiyunactually requires (and always did require!) 4 characters: 9*4882a593Smuzhiyun 10*4882a593Smuzhiyun str: a'b => a'\''b 11*4882a593Smuzhiyun len: 3 => 6 (2 for the letters + 4 for the quote) 12*4882a593Smuzhiyun 13*4882a593SmuzhiyunThis leads to not allocating enough memory and thus out of bounds writes 14*4882a593Smuzhiyunthat have been observed to cause heap corruption. 15*4882a593Smuzhiyun 16*4882a593SmuzhiyunAllocate 4 bytes for each single quote. 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunCommit 22e7dbb2bb81 (Fix quoting in legacy parser.) does the same 19*4882a593Smuzhiyunquoting, but it adds 3 as extra overhead on top of the single byte that 20*4882a593Smuzhiyunthe quote already needs. So it's correct. 21*4882a593Smuzhiyun 22*4882a593SmuzhiyunFixes: 9acdcbf32542 (use single quotes in menuentry setparams command) 23*4882a593SmuzhiyunFixes: CVE-2021-20233 24*4882a593Smuzhiyun 25*4882a593SmuzhiyunReported-by: Daniel Axtens <dja@axtens.net> 26*4882a593SmuzhiyunSigned-off-by: Daniel Axtens <dja@axtens.net> 27*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 28*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 29*4882a593Smuzhiyun--- 30*4882a593Smuzhiyun grub-core/commands/menuentry.c | 2 +- 31*4882a593Smuzhiyun 1 file changed, 1 insertion(+), 1 deletion(-) 32*4882a593Smuzhiyun 33*4882a593Smuzhiyundiff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c 34*4882a593Smuzhiyunindex 9164df7..720e6d8 100644 35*4882a593Smuzhiyun--- a/grub-core/commands/menuentry.c 36*4882a593Smuzhiyun+++ b/grub-core/commands/menuentry.c 37*4882a593Smuzhiyun@@ -230,7 +230,7 @@ setparams_prefix (int argc, char **args) 38*4882a593Smuzhiyun len += 3; /* 3 = 1 space + 2 quotes */ 39*4882a593Smuzhiyun p = args[i]; 40*4882a593Smuzhiyun while (*p) 41*4882a593Smuzhiyun- len += (*p++ == '\'' ? 3 : 1); 42*4882a593Smuzhiyun+ len += (*p++ == '\'' ? 4 : 1); 43*4882a593Smuzhiyun } 44*4882a593Smuzhiyun 45*4882a593Smuzhiyun result = grub_malloc (len + 2); 46*4882a593Smuzhiyun-- 47*4882a593Smuzhiyun2.14.2 48*4882a593Smuzhiyun 49