commands/menuentry: Fix for out of bound access

A menu entry with an empty title leads to an out-of-bounds access at
"ch = src[len - 1]", i.e., "src" is empty and "len" is zero. So, fixing
this by checking the menu entry title length and throwing an error if
the length is zero.

Signed-off-by: Sridhar Markonda <sridharm@linux.ibm.com>
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
index 09749c415d3fb02975cb57303425f6ab59ab23d3..5e1318f1739047597694c69c2d0c7dadf7bf0ec6 100644 (file)
--- a/grub-core/commands/menuentry.c
+++ b/grub-core/commands/menuentry.c
@@ -266,6 +266,9 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
   if (! argc)
     return grub_error (GRUB_ERR_BAD_ARGUMENT, "missing arguments");
 
+  if (! grub_strlen (args[argc - 1]))
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "menuentry title is missing");
+
   if (ctxt->state[3].set && ctxt->script)
     return grub_error (GRUB_ERR_BAD_ARGUMENT, "multiple menuentry definitions");