tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

loader/multiboot_elfxx: Check program memory isn't larger than allocated memory size

Browse Source 
In grub-core/loader/multiboot_elfxx.c, the code is filling an area of memory
with grub_memset() but doesn't check if there is space in the allocated memory
before doing so. To make sure we aren't zeroing memory past the allocated memory
region, we need to check that the offset into the allocated memory region plus
the memory size of the program is smaller than the allocated memory size.

Fixes: CID 314029
Fixes: CID 314038

Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Alec Brown 2023-05-22 16:52:46 -04:00 committed by Daniel Kiper
parent 1c0df7c142
commit 9537ddb0e7
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
grub-core/loader/multiboot_elfxx.c
View File

@ -67,7 +67,7 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
char *phdr_base;
grub_err_t err;
grub_relocator_chunk_t ch;
grub_uint32_t load_offset = 0, load_size;
grub_uint32_t load_offset = 0, load_size = 0;
Elf_Shnum shnum;
Elf_Word shstrndx, phnum;
unsigned int i;
@ -170,8 +170,9 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
}
else
{
load_size = phdr(i)->p_memsz;
err = grub_relocator_alloc_chunk_addr (GRUB_MULTIBOOT (relocator), &ch,
phdr(i)->p_paddr, phdr(i)->p_memsz);
phdr(i)->p_paddr, load_size);
if (err != GRUB_ERR_NONE)
{
@ -199,8 +200,14 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
}
if (phdr(i)->p_filesz < phdr(i)->p_memsz)
grub_memset ((grub_uint8_t *) source + load_offset + phdr(i)->p_filesz, 0,
phdr(i)->p_memsz - phdr(i)->p_filesz);
{
/* Need to insure that the memory being set isn't larger than the allocated memory. */
if (load_offset + phdr(i)->p_memsz - phdr(i)->p_filesz > load_size)
return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("memory being set is larger than allocated memory"));
grub_memset ((grub_uint8_t *) source + load_offset + phdr(i)->p_filesz, 0,
phdr(i)->p_memsz - phdr(i)->p_filesz);
}
}
}