1From 42facd577231cf5ffe4c7128fed15b7e7d99cbca Mon Sep 17 00:00:00 2001
2From: Thomas Frauendorfer | Miray Software <tf@miray.de>
3Date: Tue, 4 Aug 2020 13:49:51 +0200
4Subject: [PATCH] gfxmenu/gui: Check printf() format in the gui_progress_bar
5 and gui_label
6
7The gui_progress_bar and gui_label components can display the timeout
8value. The format string can be set through a theme file. This patch
9adds a validation step to the format string.
10
11If a user loads a theme file into the GRUB without this patch then
12a GUI label with the following settings
13
14  + label {
15  ...
16  id = "__timeout__"
17  text = "%s"
18  }
19
20will interpret the current timeout value as string pointer and print the
21memory at that position on the screen. It is not desired behavior.
22
23Signed-off-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
24Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
25Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
26---
27 grub-core/gfxmenu/gui_label.c        | 4 ++++
28 grub-core/gfxmenu/gui_progress_bar.c | 3 +++
29 2 files changed, 7 insertions(+)
30
31diff --git a/grub-core/gfxmenu/gui_label.c b/grub-core/gfxmenu/gui_label.c
32index a4c8178..1c19054 100644
33--- a/grub-core/gfxmenu/gui_label.c
34+++ b/grub-core/gfxmenu/gui_label.c
35@@ -193,6 +193,10 @@ label_set_property (void *vself, const char *name, const char *value)
36 	   else if (grub_strcmp (value, "@KEYMAP_SHORT@") == 0)
37 	    value = _("enter: boot, `e': options, `c': cmd-line");
38 	   /* FIXME: Add more templates here if needed.  */
39+
40+	  if (grub_printf_fmt_check(value, "%d") != GRUB_ERR_NONE)
41+	    value = ""; /* Unsupported format. */
42+
43 	  self->template = grub_strdup (value);
44 	  self->text = grub_xasprintf (value, self->value);
45 	}
46diff --git a/grub-core/gfxmenu/gui_progress_bar.c b/grub-core/gfxmenu/gui_progress_bar.c
47index b128f08..ace85a1 100644
48--- a/grub-core/gfxmenu/gui_progress_bar.c
49+++ b/grub-core/gfxmenu/gui_progress_bar.c
50@@ -348,6 +348,9 @@ progress_bar_set_property (void *vself, const char *name, const char *value)
51 	   Please use the shortest form available in you language.  */
52 	value = _("%ds");
53
54+      if (grub_printf_fmt_check(value, "%d") != GRUB_ERR_NONE)
55+	value = ""; /* Unsupported format. */
56+
57       self->template = grub_strdup (value);
58     }
59   else if (grub_strcmp (name, "font") == 0)
60--
612.14.2
62
63