From: Daniel Axtens Date: Fri, 15 Jan 2021 09:03:20 +0000 (+1100) Subject: term/gfxterm: Don't set up a font with glyphs that are too big X-Git-Tag: grub-2.06-rc1~73 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=829329bddb2c3e623270cc634cc9ab32e6455fe7;p=thirdparty%2Fgrub.git term/gfxterm: Don't set up a font with glyphs that are too big Catch the case where we have a font so big that it causes the number of rows or columns to be 0. Currently we continue and allocate a virtual_screen.text_buffer of size 0. We then try to use that for glpyhs and things go badly. On the emu platform, malloc() may give us a valid pointer, in which case we'll access heap memory which we shouldn't. Alternatively, it may give us NULL, in which case we'll crash. For other platforms, if I understand grub_memalign() correctly, we will receive a valid but small allocation that we will very likely later overrun. Prevent the creation of a virtual screen that isn't at least 40 cols by 12 rows. This is arbitrary, but it seems that if your width or height is half a standard 80x24 terminal, you're probably going to struggle to read anything anyway. Signed-off-by: Daniel Axtens Reviewed-by: Daniel Kiper --- diff --git a/grub-core/term/gfxterm.c b/grub-core/term/gfxterm.c index af7c090a3..b40fcce91 100644 --- a/grub-core/term/gfxterm.c +++ b/grub-core/term/gfxterm.c @@ -232,6 +232,15 @@ grub_virtual_screen_setup (unsigned int x, unsigned int y, virtual_screen.columns = virtual_screen.width / virtual_screen.normal_char_width; virtual_screen.rows = virtual_screen.height / virtual_screen.normal_char_height; + /* + * There must be a minimum number of rows and columns for the screen to + * make sense. Arbitrarily pick half of 80x24. If either dimensions is 0 + * we would allocate 0 bytes for the text_buffer. + */ + if (virtual_screen.columns < 40 || virtual_screen.rows < 12) + return grub_error (GRUB_ERR_BAD_FONT, + "font: glyphs too large to fit on screen"); + /* Allocate memory for text buffer. */ virtual_screen.text_buffer = (struct grub_colored_char *) grub_malloc (virtual_screen.columns