]> git.ipfire.org Git - thirdparty/grub.git/commit
commands/read: Fix an integer overflow when supplying more than 2^31 characters
authorJonathan Bar Or <jonathanbaror@gmail.com>
Thu, 23 Jan 2025 18:17:05 +0000 (19:17 +0100)
committerDaniel Kiper <daniel.kiper@oracle.com>
Thu, 13 Feb 2025 14:45:56 +0000 (15:45 +0100)
commitdad8f502974ed9ad0a70ae6820d17b4b142558fc
tree370c0cfd41413509e03c6aeed4def04795c4f8db
parentb970a5ed967816bbca8225994cd0ee2557bad515
commands/read: Fix an integer overflow when supplying more than 2^31 characters

The grub_getline() function currently has a signed integer variable "i"
that can be overflown when user supplies more than 2^31 characters.
It results in a memory corruption of the allocated line buffer as well
as supplying large negative values to grub_realloc().

Fixes: CVE-2025-0690
Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
Signed-off-by: Jonathan Bar Or <jonathanbaror@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/commands/read.c