tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

font: Fix several integer overflows in grub_font_construct_glyph()

Browse Source 
This patch fixes several integer overflows in grub_font_construct_glyph().
Glyphs of invalid size, zero or leading to an overflow, are rejected.
The inconsistency between "glyph" and "max_glyph_size" when grub_malloc()
returns NULL is fixed too.

Fixes: CVE-2022-2601

Reported-by: Zhang Boyang <zhangboyang.id@gmail.com>
Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Zhang Boyang 2022-08-05 01:58:27 +08:00 committed by Daniel Kiper
parent 9c76ec09ae
commit 768e1ef2fc
1 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
grub-core/font/font.c
View File

@ -1517,6 +1517,7 @@ grub_font_construct_glyph (grub_font_t hinted_font,
struct grub_video_signed_rect bounds; struct grub_video_signed_rect bounds;
static struct grub_font_glyph *glyph = 0; static struct grub_font_glyph *glyph = 0;
static grub_size_t max_glyph_size = 0; static grub_size_t max_glyph_size = 0;
grub_size_t cur_glyph_size;
ensure_comb_space (glyph_id); ensure_comb_space (glyph_id);
@ -1533,29 +1534,33 @@ grub_font_construct_glyph (grub_font_t hinted_font,
if (!glyph_id->ncomb && !glyph_id->attributes) if (!glyph_id->ncomb && !glyph_id->attributes)
return main_glyph; return main_glyph;
if (max_glyph_size < sizeof (*glyph) + (bounds.width * bounds.height + GRUB_CHAR_BIT - 1) / GRUB_CHAR_BIT) if (grub_video_bitmap_calc_1bpp_bufsz (bounds.width, bounds.height, &cur_glyph_size) ||
grub_add (sizeof (*glyph), cur_glyph_size, &cur_glyph_size))
return main_glyph;
if (max_glyph_size < cur_glyph_size)
{ {
grub_free (glyph); grub_free (glyph);
max_glyph_size = (sizeof (*glyph) + (bounds.width * bounds.height + GRUB_CHAR_BIT - 1) / GRUB_CHAR_BIT) * 2; if (grub_mul (cur_glyph_size, 2, &max_glyph_size))
if (max_glyph_size < 8) max_glyph_size = 0;
max_glyph_size = 8; glyph = max_glyph_size > 0 ? grub_malloc (max_glyph_size) : NULL;
glyph = grub_malloc (max_glyph_size);
} }
if (!glyph) if (!glyph)
{ {
max_glyph_size = 0;
grub_errno = GRUB_ERR_NONE; grub_errno = GRUB_ERR_NONE;
return main_glyph; return main_glyph;
} }
grub_memset (glyph, 0, sizeof (*glyph) grub_memset (glyph, 0, cur_glyph_size);
+ (bounds.width * bounds.height
+ GRUB_CHAR_BIT - 1) / GRUB_CHAR_BIT);
glyph->font = main_glyph->font; glyph->font = main_glyph->font;
glyph->width = bounds.width; if (bounds.width == 0 || bounds.height == 0 ||
glyph->height = bounds.height; grub_cast (bounds.width, &glyph->width) ||
glyph->offset_x = bounds.x; grub_cast (bounds.height, &glyph->height) ||
glyph->offset_y = bounds.y; grub_cast (bounds.x, &glyph->offset_x) ||
grub_cast (bounds.y, &glyph->offset_y))
return main_glyph;
if (glyph_id->attributes & GRUB_UNICODE_GLYPH_ATTRIBUTE_MIRROR) if (glyph_id->attributes & GRUB_UNICODE_GLYPH_ATTRIBUTE_MIRROR)
grub_font_blit_glyph_mirror (glyph, main_glyph, grub_font_blit_glyph_mirror (glyph, main_glyph,