normal/charset: Fix an integer overflow in grub_unicode_aglomerate_comb()

The out->ncomb is a bit-field of 8 bits. So, the max possible value is 255.
However, code in grub_unicode_aglomerate_comb() doesn't check for an
overflow when incrementing out->ncomb. If out->ncomb is already 255,
after incrementing it will get 0 instead of 256, and cause illegal
memory access in subsequent processing.

This patch introduces GRUB_UNICODE_NCOMB_MAX to represent the max
acceptable value of ncomb. The code now checks for this limit and
ignores additional combining characters when limit is reached.

Reported-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c
index 000e687bdc59fee640ea42655498e0fdf9ad8752..4f6647116bafa2d2e227f960edab6aa28819b914 100644 (file)
--- a/grub-core/normal/charset.c
+++ b/grub-core/normal/charset.c
@@ -472,6 +472,9 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen,
          if (!haveout)
            continue;
 
+         if (out->ncomb == GRUB_UNICODE_NCOMB_MAX)
+           continue;
+
          if (comb_type == GRUB_UNICODE_COMB_MC
              || comb_type == GRUB_UNICODE_COMB_ME
              || comb_type == GRUB_UNICODE_COMB_MN)

diff --git a/include/grub/unicode.h b/include/grub/unicode.h
index 71a4d1a54c02feb4407c2f76ef63bbf86f91087b..9360b0b9782cb2bdac1373a07c3fcf4648f0e09a 100644 (file)
--- a/include/grub/unicode.h
+++ b/include/grub/unicode.h
@@ -147,7 +147,9 @@ struct grub_unicode_glyph
   grub_uint8_t bidi_level:6; /* minimum: 6 */
   enum grub_bidi_type bidi_type:5; /* minimum: :5 */
 
+#define GRUB_UNICODE_NCOMB_MAX ((1 << 8) - 1)
   unsigned ncomb:8;
+
   /* Hint by unicode subsystem how wide this character usually is.
      Real width is determined by font. Set only in UTF-8 stream.  */
   int estimated_width:8;