1From 8d3ae59dee2930d640add3bba983006e1f5dd1b6 Mon Sep 17 00:00:00 2001 2From: Daniel Axtens <dja@axtens.net> 3Date: Mon, 18 Jan 2021 14:34:58 +1100 4Subject: [PATCH] fs/sfs: Fix over-read of root object name 5 6There's a read of the name of the root object that assumes that the name 7is nul-terminated within the root block. This isn't guaranteed - it seems 8SFS would require you to read multiple blocks to get a full name in general, 9but maybe that doesn't apply to the root object. 10 11Either way, figure out how much space is left in the root block and don't 12over-read it. This fixes some OOB reads. 13 14Signed-off-by: Daniel Axtens <dja@axtens.net> 15Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 16Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 17--- 18 grub-core/fs/sfs.c | 9 ++++++++- 19 1 file changed, 8 insertions(+), 1 deletion(-) 20 21diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c 22index de2b107..983e880 100644 23--- a/grub-core/fs/sfs.c 24+++ b/grub-core/fs/sfs.c 25@@ -373,6 +373,7 @@ grub_sfs_mount (grub_disk_t disk) 26 struct grub_sfs_objc *rootobjc; 27 char *rootobjc_data = 0; 28 grub_uint32_t blk; 29+ unsigned int max_len; 30 31 data = grub_malloc (sizeof (*data)); 32 if (!data) 33@@ -421,7 +422,13 @@ grub_sfs_mount (grub_disk_t disk) 34 data->diropen.data = data; 35 data->diropen.cache = 0; 36 data->disk = disk; 37- data->label = grub_strdup ((char *) (rootobjc->objects[0].filename)); 38+ 39+ /* We only read 1 block of data, so truncate the name if needed. */ 40+ max_len = ((GRUB_DISK_SECTOR_SIZE << data->log_blocksize) 41+ - 24 /* offsetof (struct grub_sfs_objc, objects) */ 42+ - 25); /* offsetof (struct grub_sfs_obj, filename) */ 43+ data->label = grub_zalloc (max_len + 1); 44+ grub_strncpy (data->label, (char *) rootobjc->objects[0].filename, max_len); 45 46 grub_free (rootobjc_data); 47 return data; 48-- 492.14.2 50 51