diff options
Diffstat (limited to 'meta/recipes-bsp/grub/files/CVE-2021-20233.patch')
-rw-r--r-- | meta/recipes-bsp/grub/files/CVE-2021-20233.patch | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/meta/recipes-bsp/grub/files/CVE-2021-20233.patch b/meta/recipes-bsp/grub/files/CVE-2021-20233.patch new file mode 100644 index 0000000000..d2069afc18 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2021-20233.patch | |||
@@ -0,0 +1,50 @@ | |||
1 | From 2f533a89a8dfcacbf2c9dbc77d910f111f24bf33 Mon Sep 17 00:00:00 2001 | ||
2 | From: Daniel Axtens <dja@axtens.net> | ||
3 | Date: Fri, 22 Jan 2021 17:10:48 +1100 | ||
4 | Subject: commands/menuentry: Fix quoting in setparams_prefix() | ||
5 | |||
6 | Commit 9acdcbf32542 (use single quotes in menuentry setparams command) | ||
7 | says that expressing a quoted single quote will require 3 characters. It | ||
8 | actually requires (and always did require!) 4 characters: | ||
9 | |||
10 | str: a'b => a'\''b | ||
11 | len: 3 => 6 (2 for the letters + 4 for the quote) | ||
12 | |||
13 | This leads to not allocating enough memory and thus out of bounds writes | ||
14 | that have been observed to cause heap corruption. | ||
15 | |||
16 | Allocate 4 bytes for each single quote. | ||
17 | |||
18 | Commit 22e7dbb2bb81 (Fix quoting in legacy parser.) does the same | ||
19 | quoting, but it adds 3 as extra overhead on top of the single byte that | ||
20 | the quote already needs. So it's correct. | ||
21 | |||
22 | Fixes: 9acdcbf32542 (use single quotes in menuentry setparams command) | ||
23 | Fixes: CVE-2021-20233 | ||
24 | |||
25 | Reported-by: Daniel Axtens <dja@axtens.net> | ||
26 | Signed-off-by: Daniel Axtens <dja@axtens.net> | ||
27 | |||
28 | Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?h=grub-2.06&id=2f533a89a8dfcacbf2c9dbc77d910f111f24bf33] | ||
29 | CVE: CVE-2021-20233 | ||
30 | Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> | ||
31 | --- | ||
32 | grub-core/commands/menuentry.c | 2 +- | ||
33 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
34 | |||
35 | diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c | ||
36 | index 9164df7..720e6d8 100644 | ||
37 | --- a/grub-core/commands/menuentry.c | ||
38 | +++ b/grub-core/commands/menuentry.c | ||
39 | @@ -230,7 +230,7 @@ setparams_prefix (int argc, char **args) | ||
40 | len += 3; /* 3 = 1 space + 2 quotes */ | ||
41 | p = args[i]; | ||
42 | while (*p) | ||
43 | - len += (*p++ == '\'' ? 3 : 1); | ||
44 | + len += (*p++ == '\'' ? 4 : 1); | ||
45 | } | ||
46 | |||
47 | result = grub_malloc (len + 2); | ||
48 | -- | ||
49 | 2.25.1 | ||
50 | |||