1From a8cc95de74ccc3ad090e8062ac335c844f13c9f4 Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Thu, 21 Jan 2021 17:59:14 +1100
4Subject: [PATCH] disk/lvm: Don't go beyond the end of the data we read from
5 disk
6
7We unconditionally trusted offset_xl from the LVM label header, even if
8it told us that the PV header/disk locations were way off past the end
9of the data we read from disk.
10
11Require that the offset be sane, fixing an OOB read and crash.
12
13Fixes: CID 314367, CID 314371
14
15Signed-off-by: Daniel Axtens <dja@axtens.net>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
18---
19 grub-core/disk/lvm.c | 14 ++++++++++++++
20 1 file changed, 14 insertions(+)
21
22diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
23index 139fafd..8136122 100644
24--- a/grub-core/disk/lvm.c
25+++ b/grub-core/disk/lvm.c
26@@ -141,6 +141,20 @@ grub_lvm_detect (grub_disk_t disk,
27       goto fail;
28     }
29
30+  /*
31+   * We read a grub_lvm_pv_header and then 2 grub_lvm_disk_locns that
32+   * immediately follow the PV header. Make sure we have space for both.
33+   */
34+  if (grub_le_to_cpu32 (lh->offset_xl) >=
35+      GRUB_LVM_LABEL_SIZE - sizeof (struct grub_lvm_pv_header) -
36+      2 * sizeof (struct grub_lvm_disk_locn))
37+    {
38+#ifdef GRUB_UTIL
39+      grub_util_info ("LVM PV header/disk locations are beyond the end of the block");
40+#endif
41+      goto fail;
42+    }
43+
44   pvh = (struct grub_lvm_pv_header *) (buf + grub_le_to_cpu32(lh->offset_xl));
45
46   for (i = 0, j = 0; i < GRUB_LVM_ID_LEN; i++)
47--
482.14.2
49
50