From 549a9cc372fd0b96a4ccdfad0e12140476cc62a3 Mon Sep 17 00:00:00 2001 From: Jamie Date: Mon, 14 Jul 2025 09:52:59 +0100 Subject: [PATCH] commands/usbtest: Use correct string length field An incorrect length field is used for buffer allocation. This leads to grub_utf16_to_utf8() receiving an incorrect/different length and possibly causing OOB write. This makes sure to use the correct length. Fixes: CVE-2025-61661 Reported-by: Jamie Signed-off-by: Jamie Reviewed-by: Daniel Kiper --- grub-core/commands/usbtest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/commands/usbtest.c b/grub-core/commands/usbtest.c index 2c6d93fe6..8ef187a9a 100644 --- a/grub-core/commands/usbtest.c +++ b/grub-core/commands/usbtest.c @@ -99,7 +99,7 @@ grub_usb_get_string (grub_usb_device_t dev, grub_uint8_t index, int langid, return GRUB_USB_ERR_NONE; } - *string = grub_malloc (descstr.length * 2 + 1); + *string = grub_malloc (descstrp->length * 2 + 1); if (! *string) { grub_free (descstrp);