From: Darren Kenny Date: Fri, 11 Dec 2020 15:03:13 +0000 (+0000) Subject: kern/efi/mm: Fix possible NULL pointer dereference X-Git-Tag: grub-2.06-rc1~121 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6aee4bfd6973c714056fb7b56890b8d524e94ee1;p=thirdparty%2Fgrub.git kern/efi/mm: Fix possible NULL pointer dereference The model of grub_efi_get_memory_map() is that if memory_map is NULL, then the purpose is to discover how much memory should be allocated to it for the subsequent call. The problem here is that with grub_efi_is_finished set to 1, there is no check at all that the function is being called with a non-NULL memory_map. While this MAY be true, we shouldn't assume it. The solution to this is to behave as expected, and if memory_map is NULL, then don't try to use it and allow memory_map_size to be filled in, and return 0 as is done later in the code if the buffer is too small (or NULL). Additionally, drop unneeded ret = 1. Fixes: CID 96632 Signed-off-by: Darren Kenny Reviewed-by: Daniel Kiper --- diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c index 457772d57..8d380c054 100644 --- a/grub-core/kern/efi/mm.c +++ b/grub-core/kern/efi/mm.c @@ -339,15 +339,24 @@ grub_efi_get_memory_map (grub_efi_uintn_t *memory_map_size, if (grub_efi_is_finished) { int ret = 1; - if (*memory_map_size < finish_mmap_size) + + if (memory_map != NULL) { - grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size); - ret = 0; + if (*memory_map_size < finish_mmap_size) + { + grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size); + ret = 0; + } + else + grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size); } else { - grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size); - ret = 1; + /* + * Incomplete, no buffer to copy into, same as + * GRUB_EFI_BUFFER_TOO_SMALL below. + */ + ret = 0; } *memory_map_size = finish_mmap_size; if (map_key)