From: Darren Kenny Date: Tue, 26 Oct 2021 15:02:39 +0000 (+0000) Subject: fs/zfs/zfs: Fix possible insecure use of chunk size in zap_leaf_array_get() X-Git-Tag: grub-2.12-rc1~530 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb9ff31641b00a8abd79feb37a845a1d4066b9bb;p=thirdparty%2Fgrub.git fs/zfs/zfs: Fix possible insecure use of chunk size in zap_leaf_array_get() In zap_leaf_array_get() the chunk size passed in is considered tainted by Coverity, and is being used before it is tested for validity. To fix this the assignment of "la" is moved until after the test of the value of "chunk". Fixes: CID 314014 Signed-off-by: Darren Kenny Reviewed-by: Daniel Kiper --- diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c index 44e4e1814..e9d7a7d0e 100644 --- a/grub-core/fs/zfs/zfs.c +++ b/grub-core/fs/zfs/zfs.c @@ -2229,7 +2229,7 @@ zap_leaf_array_get (zap_leaf_phys_t * l, grub_zfs_endian_t endian, int blksft, while (bseen < array_len) { - struct zap_leaf_array *la = &ZAP_LEAF_CHUNK (l, blksft, chunk)->l_array; + struct zap_leaf_array *la; grub_size_t toread = array_len - bseen; if (toread > ZAP_LEAF_ARRAY_BYTES) @@ -2239,6 +2239,7 @@ zap_leaf_array_get (zap_leaf_phys_t * l, grub_zfs_endian_t endian, int blksft, /* Don't use grub_error because this error is to be ignored. */ return GRUB_ERR_BAD_FS; + la = &ZAP_LEAF_CHUNK (l, blksft, chunk)->l_array; grub_memcpy (buf + bseen,la->la_array, toread); chunk = grub_zfs_to_cpu16 (la->la_next, endian); bseen += toread;