1*4882a593SmuzhiyunFrom 829329bddb2c3e623270cc634cc9ab32e6455fe7 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Daniel Axtens <dja@axtens.net> 3*4882a593SmuzhiyunDate: Fri, 15 Jan 2021 20:03:20 +1100 4*4882a593SmuzhiyunSubject: [PATCH] term/gfxterm: Don't set up a font with glyphs that are too 5*4882a593Smuzhiyun big 6*4882a593Smuzhiyun 7*4882a593SmuzhiyunCatch the case where we have a font so big that it causes the number of 8*4882a593Smuzhiyunrows or columns to be 0. Currently we continue and allocate a 9*4882a593Smuzhiyunvirtual_screen.text_buffer of size 0. We then try to use that for glpyhs 10*4882a593Smuzhiyunand things go badly. 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunOn the emu platform, malloc() may give us a valid pointer, in which case 13*4882a593Smuzhiyunwe'll access heap memory which we shouldn't. Alternatively, it may give us 14*4882a593SmuzhiyunNULL, in which case we'll crash. For other platforms, if I understand 15*4882a593Smuzhiyungrub_memalign() correctly, we will receive a valid but small allocation 16*4882a593Smuzhiyunthat we will very likely later overrun. 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunPrevent the creation of a virtual screen that isn't at least 40 cols 19*4882a593Smuzhiyunby 12 rows. This is arbitrary, but it seems that if your width or height 20*4882a593Smuzhiyunis half a standard 80x24 terminal, you're probably going to struggle to 21*4882a593Smuzhiyunread anything anyway. 22*4882a593Smuzhiyun 23*4882a593SmuzhiyunSigned-off-by: Daniel Axtens <dja@axtens.net> 24*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 25*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 26*4882a593Smuzhiyun--- 27*4882a593Smuzhiyun grub-core/term/gfxterm.c | 9 +++++++++ 28*4882a593Smuzhiyun 1 file changed, 9 insertions(+) 29*4882a593Smuzhiyun 30*4882a593Smuzhiyundiff --git a/grub-core/term/gfxterm.c b/grub-core/term/gfxterm.c 31*4882a593Smuzhiyunindex af7c090..b40fcce 100644 32*4882a593Smuzhiyun--- a/grub-core/term/gfxterm.c 33*4882a593Smuzhiyun+++ b/grub-core/term/gfxterm.c 34*4882a593Smuzhiyun@@ -232,6 +232,15 @@ grub_virtual_screen_setup (unsigned int x, unsigned int y, 35*4882a593Smuzhiyun virtual_screen.columns = virtual_screen.width / virtual_screen.normal_char_width; 36*4882a593Smuzhiyun virtual_screen.rows = virtual_screen.height / virtual_screen.normal_char_height; 37*4882a593Smuzhiyun 38*4882a593Smuzhiyun+ /* 39*4882a593Smuzhiyun+ * There must be a minimum number of rows and columns for the screen to 40*4882a593Smuzhiyun+ * make sense. Arbitrarily pick half of 80x24. If either dimensions is 0 41*4882a593Smuzhiyun+ * we would allocate 0 bytes for the text_buffer. 42*4882a593Smuzhiyun+ */ 43*4882a593Smuzhiyun+ if (virtual_screen.columns < 40 || virtual_screen.rows < 12) 44*4882a593Smuzhiyun+ return grub_error (GRUB_ERR_BAD_FONT, 45*4882a593Smuzhiyun+ "font: glyphs too large to fit on screen"); 46*4882a593Smuzhiyun+ 47*4882a593Smuzhiyun /* Allocate memory for text buffer. */ 48*4882a593Smuzhiyun virtual_screen.text_buffer = 49*4882a593Smuzhiyun (struct grub_colored_char *) grub_malloc (virtual_screen.columns 50*4882a593Smuzhiyun-- 51*4882a593Smuzhiyun2.14.2 52*4882a593Smuzhiyun 53