2009-08-28 Vladimir Serbinenko <phcoder@gmail.com>

	* kern/file.c (grub_file_read): Check offset.
	* fs/hfs.c (grub_hfs_read_file): Remove unnecessary offset check.
	* fs/jfs.c (grub_jfs_read_file): Likewise.
	* fs/ntfs.c (grub_ntfs_read): Likewise.
	* fs/reiserfs.c (grub_reiserfs_read): Likewise.
	* fs/minix.c (grub_minix_read_file): Correct offset check.
	* fs/ufs.c (grub_ufs_read_file): Likewise.

diff --git a/ChangeLog b/ChangeLog
index 1858a9cbb5c6acb31efa18bbf45bec35c26da041..b657885fed4f66b86a64e42bbf0b7458376ba27f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2009-08-28  Vladimir Serbinenko  <phcoder@gmail.com>
+
+       * kern/file.c (grub_file_read): Check offset.
+       * fs/hfs.c (grub_hfs_read_file): Remove unnecessary offset check.
+       * fs/jfs.c (grub_jfs_read_file): Likewise.
+       * fs/ntfs.c (grub_ntfs_read): Likewise.
+       * fs/reiserfs.c (grub_reiserfs_read): Likewise.
+       * fs/minix.c (grub_minix_read_file): Correct offset check.
+       * fs/ufs.c (grub_ufs_read_file): Likewise.
+
 2009-08-28  Colin Watson  <cjwatson@ubuntu.com>
 
        * term/i386/pc/console.c (bios_data_area): Cast

diff --git a/fs/hfs.c b/fs/hfs.c
index 2f0702cbb8f3a48cd6a791836fd4ab7c14bd5880..5062b5f71e5b4557530386ceee18bc37680f676f 100644 (file)
--- a/fs/hfs.c
+++ b/fs/hfs.c
@@ -243,10 +243,6 @@ grub_hfs_read_file (struct grub_hfs_data *data,
   int i;
   int blockcnt;
 
-  /* Adjust len so it we can't read past the end of the file.  */
-  if (len > grub_le_to_cpu32 (data->size))
-    len = grub_le_to_cpu32 (data->size);
-
   blockcnt = ((len + pos)
              + data->blksz - 1) / data->blksz;
 

diff --git a/fs/jfs.c b/fs/jfs.c
index 51ca91ad0256151030781d0fe74c7d3bc83c0fe3..b73f9bdd47065093dd7cca4b3bf5304397fed9f1 100644 (file)
--- a/fs/jfs.c
+++ b/fs/jfs.c
@@ -544,10 +544,6 @@ grub_jfs_read_file (struct grub_jfs_data *data,
   int i;
   int blockcnt;
 
-  /* Adjust len so it we can't read past the end of the file.  */
-  if (len > data->currinode.size)
-    len = data->currinode.size;
-
   blockcnt = ((len + pos + grub_le_to_cpu32 (data->sblock.blksz) - 1)
              / grub_le_to_cpu32 (data->sblock.blksz));
 

diff --git a/fs/minix.c b/fs/minix.c
index 44218fb8959c0d722875101c4cb5b502cfe21869..08eb607291fdf5749e5e2525ba1db58b26eb8f4e 100644 (file)
--- a/fs/minix.c
+++ b/fs/minix.c
@@ -193,8 +193,8 @@ grub_minix_read_file (struct grub_minix_data *data,
   int blockcnt;
 
   /* Adjust len so it we can't read past the end of the file.  */
-  if (len > GRUB_MINIX_INODE_SIZE (data))
-    len = GRUB_MINIX_INODE_SIZE (data);
+  if (len + pos > GRUB_MINIX_INODE_SIZE (data))
+    len = GRUB_MINIX_INODE_SIZE (data) - pos;
 
   blockcnt = (len + pos + GRUB_MINIX_BSIZE - 1) / GRUB_MINIX_BSIZE;
 

diff --git a/fs/ntfs.c b/fs/ntfs.c
index d03a9401604e8b692a3c7e117bc94bfc42eb3ab8..3ff487c6e8460a54b3384dec34d76ef05846bc47 100644 (file)
--- a/fs/ntfs.c
+++ b/fs/ntfs.c
@@ -970,15 +970,6 @@ grub_ntfs_read (grub_file_t file, char *buf, grub_size_t len)
   if (file->read_hook)
     mft->attr.save_pos = 1;
 
-  if (file->offset > file->size)
-    {
-      grub_error (GRUB_ERR_BAD_FS, "Bad offset");
-      return -1;
-    }
-
-  if (file->offset + len > file->size)
-    len = file->size - file->offset;
-
   read_attr (&mft->attr, buf, file->offset, len, 1, file->read_hook);
   return (grub_errno) ? 0 : len;
 }

diff --git a/fs/reiserfs.c b/fs/reiserfs.c
index 04d33150fe0e9cdf9cc9a6e5cd143ea99ce41daf..fb4f1bc5921dfc2f87aa7718943afadb460d4b16 100644 (file)
--- a/fs/reiserfs.c
+++ b/fs/reiserfs.c
@@ -1077,9 +1077,6 @@ grub_reiserfs_read (grub_file_t file, char *buf, grub_size_t len)
   grub_disk_addr_t block;
   grub_off_t offset;
 
-  if (file->offset >= file->size)
-    return 0;
-
   key.directory_id = node->header.key.directory_id;
   key.object_id = node->header.key.object_id;
   key.u.v2.offset_type = 0;

diff --git a/fs/ufs.c b/fs/ufs.c
index 797a45d134ac2478ab79aa0a61bdabeaf72ab176..c94ad992245ec51213dafb40c4dc1b25aad088c8 100644 (file)
--- a/fs/ufs.c
+++ b/fs/ufs.c
@@ -290,8 +290,8 @@ grub_ufs_read_file (struct grub_ufs_data *data,
   int blockcnt;
 
   /* Adjust len so it we can't read past the end of the file.  */
-  if (len > INODE_SIZE (data))
-    len = INODE_SIZE (data);
+  if (len + pos > INODE_SIZE (data))
+    len = INODE_SIZE (data) - pos;
 
   blockcnt = (len + pos + UFS_BLKSZ (sblock) - 1) / UFS_BLKSZ (sblock);
 

diff --git a/kern/file.c b/kern/file.c
index 9b56b88e439dbd0817f42b7239d11844658ea537..22f2f60932c90519c4ad40b7ca7399a469aba358 100644 (file)
--- a/kern/file.c
+++ b/kern/file.c
@@ -112,6 +112,13 @@ grub_file_read (grub_file_t file, void *buf, grub_size_t len)
 {
   grub_ssize_t res;
 
+  if (file->offset > file->size)
+    {
+      grub_error (GRUB_ERR_OUT_OF_RANGE,
+                 "Attempt to read pat the end of file.");
+      return -1;
+    }
+
   if (len == 0 || len > file->size - file->offset)
     len = file->size - file->offset;