A menu entry with an empty title leads to an out-of-bounds access at
"ch = src[len - 1]", i.e., "src" is empty and "len" is zero. So, fixing
this by checking the menu entry title length and throwing an error if
the length is zero.
Signed-off-by: Sridhar Markonda <sridharm@linux.ibm.com>
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
The BootLoaderSpec (BLS) defines a scheme where different bootloaders can
share a format for boot items and a configuration directory that accepts
these common configurations as drop-in files.
The BLS Specification: https://uapi-group.org/specifications/specs/boot_loader_specification/
Signed-off-by: Peter Jones <pjones@redhat.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Will Thompson <wjt@endlessm.com>
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Commit 9acdcbf32542 (use single quotes in menuentry setparams command)
says that expressing a quoted single quote will require 3 characters. It
actually requires (and always did require!) 4 characters:
str: a'b => a'\''b
len: 3 => 6 (2 for the letters + 4 for the quote)
This leads to not allocating enough memory and thus out of bounds writes
that have been observed to cause heap corruption.
Allocate 4 bytes for each single quote.
Commit 22e7dbb2bb81 (Fix quoting in legacy parser.) does the same
quoting, but it adds 3 as extra overhead on top of the single byte that
the quote already needs. So it's correct.
Fixes: 9acdcbf32542 (use single quotes in menuentry setparams command)
Fixes: CVE-2021-20233
Reported-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This modifies most of the places we do some form of:
X = malloc(Y * Z);
to use calloc(Y, Z) instead.
Among other issues, this fixes:
- allocation of integer overflow in grub_png_decode_image_header()
reported by Chris Coulson,
- allocation of integer overflow in luks_recover_key()
reported by Chris Coulson,
- allocation of integer overflow in grub_lvm_detect()
reported by Chris Coulson.
Fixes: CVE-2020-14308
Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
* grub-core/commands/menuentry.c (grub_normal_add_menu_entry): New
parameter submenu. All users updated.
* grub-core/normal/main.c (free_menu): Rename to ...
(grub_normal_free_menu): ... this. Made global.
* grub-core/normal/menu.c (grub_menu_execute_entry): Open new context
if requested.
* grub-core/normal/menu_entry.c (screen): New field submenu.
(make_screen): Set submenu.
(run): Open new context if requested.
* include/grub/menu.h (grub_menu_entry): New field submenu.
* include/grub/normal.h (grub_normal_free_menu): New proto.
* Makefile.util.def (grub-mklayout): New file.
(grub-kbdcomp): New script.
* grub-core/Makefile.am (KERNEL_HEADER_FILES) [COND_mips_yeeloong]:
Add keyboard_layouts.h.
* grub-core/Makefile.core.def (kernel): Add commands/keylayouts.c and
commands/boot.c on yeeloong.
(keylayouts): New module.
* grub-core/bus/usb/ohci.c
* grub-core/bus/usb/uhci.c
* grub-core/bus/usb/usbhub.c (rescan): New variable.
(grub_usb_add_hub): Poll interrupt pipe for device handling.
(attach_root_port): Likewise.
(poll_nonroot_hub): Likewise.
(grub_usb_poll_devices): Likewise.
(detach_device): Close transfer.
* grub-core/bus/usb/usbtrans.c (grub_usb_execute_and_wait_transfer): New
function.
(grub_usb_bulk_setup_readwrite): Likewise.
(grub_usb_bulk_finish_readwrite): Likewise.
* grub-core/commands/keylayouts.c: New file.
* grub-core/commands/keystatus.c (grub_getkeystatus): New function.
* grub-core/commands/menuentry.c (hotkey_aliases): All several new
aliases.
* grub-core/term/at_keyboard.c: Restructured to use keylayouts and
support scancode 2.
* grub-core/term/usb_keyboard.c: Restructured to use keylayouts.
* include/grub/keyboard_layouts.h: New file.
* util/grub-mklayout.c: New file.
* util/grub-kbdcomp.in: Likewise.
Also-By: Aleš Nesrsta <starous@volny.cz>
Also-By: Vladimir Serbinenko <phcoder@gmail.com>
