1*4882a593SmuzhiyunFrom b5bc456f664bc301ab4cd5a17d3d23c6661c259e Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Daniel Axtens <dja@axtens.net> 3*4882a593SmuzhiyunDate: Mon, 18 Jan 2021 11:46:39 +1100 4*4882a593SmuzhiyunSubject: [PATCH] fs/fshelp: Catch impermissibly large block sizes in read 5*4882a593Smuzhiyun helper 6*4882a593Smuzhiyun 7*4882a593SmuzhiyunA fuzzed HFS+ filesystem had log2blocksize = 22. This gave 8*4882a593Smuzhiyunlog2blocksize + GRUB_DISK_SECTOR_BITS = 31. 1 << 31 = 0x80000000, 9*4882a593Smuzhiyunwhich is -1 as an int. This caused some wacky behavior later on in 10*4882a593Smuzhiyunthe function, leading to out-of-bounds writes on the destination buffer. 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunCatch log2blocksize + GRUB_DISK_SECTOR_BITS >= 31. We could be stricter, 13*4882a593Smuzhiyunbut this is the minimum that will prevent integer size weirdness. 14*4882a593Smuzhiyun 15*4882a593SmuzhiyunSigned-off-by: Daniel Axtens <dja@axtens.net> 16*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 17*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 18*4882a593Smuzhiyun--- 19*4882a593Smuzhiyun grub-core/fs/fshelp.c | 12 ++++++++++++ 20*4882a593Smuzhiyun 1 file changed, 12 insertions(+) 21*4882a593Smuzhiyun 22*4882a593Smuzhiyundiff --git a/grub-core/fs/fshelp.c b/grub-core/fs/fshelp.c 23*4882a593Smuzhiyunindex 4c902ad..a2d0d29 100644 24*4882a593Smuzhiyun--- a/grub-core/fs/fshelp.c 25*4882a593Smuzhiyun+++ b/grub-core/fs/fshelp.c 26*4882a593Smuzhiyun@@ -362,6 +362,18 @@ grub_fshelp_read_file (grub_disk_t disk, grub_fshelp_node_t node, 27*4882a593Smuzhiyun grub_disk_addr_t i, blockcnt; 28*4882a593Smuzhiyun int blocksize = 1 << (log2blocksize + GRUB_DISK_SECTOR_BITS); 29*4882a593Smuzhiyun 30*4882a593Smuzhiyun+ /* 31*4882a593Smuzhiyun+ * Catch blatantly invalid log2blocksize. We could be a lot stricter, but 32*4882a593Smuzhiyun+ * this is the most permissive we can be before we start to see integer 33*4882a593Smuzhiyun+ * overflow/underflow issues. 34*4882a593Smuzhiyun+ */ 35*4882a593Smuzhiyun+ if (log2blocksize + GRUB_DISK_SECTOR_BITS >= 31) 36*4882a593Smuzhiyun+ { 37*4882a593Smuzhiyun+ grub_error (GRUB_ERR_OUT_OF_RANGE, 38*4882a593Smuzhiyun+ N_("blocksize too large")); 39*4882a593Smuzhiyun+ return -1; 40*4882a593Smuzhiyun+ } 41*4882a593Smuzhiyun+ 42*4882a593Smuzhiyun if (pos > filesize) 43*4882a593Smuzhiyun { 44*4882a593Smuzhiyun grub_error (GRUB_ERR_OUT_OF_RANGE, 45*4882a593Smuzhiyun-- 46*4882a593Smuzhiyun2.14.2 47*4882a593Smuzhiyun 48