tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kern/efi/mm: Fix possible NULL pointer dereference

Browse Source 
The model of grub_efi_get_memory_map() is that if memory_map is NULL,
then the purpose is to discover how much memory should be allocated to
it for the subsequent call.

The problem here is that with grub_efi_is_finished set to 1, there is no
check at all that the function is being called with a non-NULL memory_map.

While this MAY be true, we shouldn't assume it.

The solution to this is to behave as expected, and if memory_map is NULL,
then don't try to use it and allow memory_map_size to be filled in, and
return 0 as is done later in the code if the buffer is too small (or NULL).

Additionally, drop unneeded ret = 1.

Fixes: CID 96632

Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Darren Kenny 2020-12-11 15:03:13 +00:00 committed by Daniel Kiper
parent ed286ceba6
commit 6aee4bfd69
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
grub-core/kern/efi/mm.c
View File

@ -339,15 +339,24 @@ grub_efi_get_memory_map (grub_efi_uintn_t *memory_map_size,
if (grub_efi_is_finished)
{
int ret = 1;
if (*memory_map_size < finish_mmap_size)
if (memory_map != NULL)
{
grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size);
ret = 0;
if (*memory_map_size < finish_mmap_size)
{
grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size);
ret = 0;
}
else
grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size);
}
else
{
grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size);
ret = 1;
/*
* Incomplete, no buffer to copy into, same as
* GRUB_EFI_BUFFER_TOO_SMALL below.
*/
ret = 0;
}
*memory_map_size = finish_mmap_size;
if (map_key)