]> git.ipfire.org Git - thirdparty/grub.git/commit
fs/fshelp: Catch impermissibly large block sizes in read helper
authorDaniel Axtens <dja@axtens.net>
Mon, 18 Jan 2021 00:46:39 +0000 (11:46 +1100)
committerDaniel Kiper <daniel.kiper@oracle.com>
Tue, 2 Mar 2021 14:54:18 +0000 (15:54 +0100)
commitb5bc456f664bc301ab4cd5a17d3d23c6661c259e
treec407160fae902bab9d19fd6ab879e1e816ca025f
parent829329bddb2c3e623270cc634cc9ab32e6455fe7
fs/fshelp: Catch impermissibly large block sizes in read helper

A fuzzed HFS+ filesystem had log2blocksize = 22. This gave
log2blocksize + GRUB_DISK_SECTOR_BITS = 31. 1 << 31 = 0x80000000,
which is -1 as an int. This caused some wacky behavior later on in
the function, leading to out-of-bounds writes on the destination buffer.

Catch log2blocksize + GRUB_DISK_SECTOR_BITS >= 31. We could be stricter,
but this is the minimum that will prevent integer size weirdness.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/fs/fshelp.c