Open Build Service

_service:tar_scm:grub2.spec Changed

_service:tar_scm:backport-fs-udf-Fix-out-of-bounds-access.patch Added

@@ -0,0 +1,119 @@
+From a24ea9241cb42e8ba670ac8d8ce54275df73a271 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Wed, 7 Jun 2023 01:31:06 +0000
+Subject: fs/udf: Fix out of bounds access
+
+Implemented a boundary check before advancing the allocation
+descriptors pointer.
+
+Reference:https://git.savannah.gnu.org/cgit/grub.git/commit?id=a24ea9241cb42e8ba670ac8d8ce54275df73a271
+Conflict:NA
+
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/fs/udf.c | 38 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
+index 7679ea3..b836e61 100644
+--- a/grub-core/fs/udf.c
++++ b/grub-core/fs/udf.c
+@@ -114,6 +114,10 @@ GRUB_MOD_LICENSE ("GPLv3+");
+ #define GRUB_UDF_PARTMAP_TYPE_1		1
+ #define GRUB_UDF_PARTMAP_TYPE_2		2
+ 
++#define GRUB_UDF_INVALID_STRUCT_PTR(_ptr, _struct)	\
++  ((char *) (_ptr) >= end_ptr || \
++   ((grub_ssize_t) (end_ptr - (char *) (_ptr)) < (grub_ssize_t) sizeof (_struct)))
++
+ struct grub_udf_lb_addr
+ {
+   grub_uint32_t block_num;
+@@ -458,6 +462,7 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
+   char *ptr;
+   grub_ssize_t len;
+   grub_disk_addr_t filebytes;
++  char *end_ptr;
+ 
+   switch (U16 (node->block.fe.tag.tag_ident))
+     {
+@@ -476,9 +481,17 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
+       return 0;
+     }
+ 
++  end_ptr = (char *) node + get_fshelp_size (node->data);
++
+   if ((U16 (node->block.fe.icbtag.flags) & GRUB_UDF_ICBTAG_FLAG_AD_MASK)
+       == GRUB_UDF_ICBTAG_FLAG_AD_SHORT)
+     {
++      if (GRUB_UDF_INVALID_STRUCT_PTR (ptr, struct grub_udf_short_ad))
++	{
++	  grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
++	  return 0;
++	}
++
+       struct grub_udf_short_ad *ad = (struct grub_udf_short_ad *) ptr;
+ 
+       filebytes = fileblock * U32 (node->data->lvd.bsize);
+@@ -542,10 +555,22 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
+ 	  filebytes -= adlen;
+ 	  ad++;
+ 	  len -= sizeof (struct grub_udf_short_ad);
++
++	  if (GRUB_UDF_INVALID_STRUCT_PTR (ad, struct grub_udf_short_ad))
++	    {
++	      grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
++	      return 0;
++	    }
+ 	}
+     }
+   else
+     {
++      if (GRUB_UDF_INVALID_STRUCT_PTR (ptr, struct grub_udf_long_ad))
++	{
++	  grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
++	  return 0;
++	}
++
+       struct grub_udf_long_ad *ad = (struct grub_udf_long_ad *) ptr;
+ 
+       filebytes = fileblock * U32 (node->data->lvd.bsize);
+@@ -611,6 +636,12 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
+ 	  filebytes -= adlen;
+ 	  ad++;
+ 	  len -= sizeof (struct grub_udf_long_ad);
++
++	  if (GRUB_UDF_INVALID_STRUCT_PTR (ad, struct grub_udf_long_ad))
++	    {
++	      grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
++	      return 0;
++	    }
+ 	}
+     }
+ 
+@@ -630,6 +661,7 @@ grub_udf_read_file (grub_fshelp_node_t node,
+     case GRUB_UDF_ICBTAG_FLAG_AD_IN_ICB:
+       {
+ 	char *ptr;
++	char *end_ptr = (char *) node + get_fshelp_size (node->data);
+ 
+ 	ptr = ((U16 (node->block.fe.tag.tag_ident) == GRUB_UDF_TAG_IDENT_FE) ?
+ 	       ((char *) &node->block.fe.ext_attr[0]
+@@ -637,6 +669,12 @@ grub_udf_read_file (grub_fshelp_node_t node,
+ 	       ((char *) &node->block.efe.ext_attr[0]
+                 + U32 (node->block.efe.ext_attr_length)));
+ 
++	if ((ptr + pos + len) > end_ptr)
++	  {
++	    grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
++	    return 0;
++	  }
++
+ 	grub_memcpy (buf, ptr + pos, len);
+ 
+ 	return len;
+-- 
+cgit v1.1
+

_service:tar_scm:backport-lib-relocator-Fix-OOB-write-when-initializing-lo-freebytes.patch Added

@@ -0,0 +1,38 @@
+From 9dbfbcd660470c3b951d15af0f6ce5a423185ad2 Mon Sep 17 00:00:00 2001
+From: Daniel Kiper <daniel.kiper@oracle.com>
+Date: Fri, 23 Jun 2023 00:02:24 +0200
+Subject: lib/relocator: Fix OOB write when initializing lo->freebytes[]
+
+Fixes: CID 96636
+
+Reference:https://git.savannah.gnu.org/cgit/grub.git/commit?id=9dbfbcd660470c3b951d15af0f6ce5a423185ad2
+Conflict:NA
+
+Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Vladimir Serbinenko <phcoder@gmail.com>
+---
+ grub-core/lib/relocator.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/grub-core/lib/relocator.c b/grub-core/lib/relocator.c
+index 568fc0b..e0478ae 100644
+--- a/grub-core/lib/relocator.c
++++ b/grub-core/lib/relocator.c
+@@ -881,9 +881,11 @@ malloc_in_range (struct grub_relocator *rel,
+ 			offend = GRUB_RELOCATOR_FIRMWARE_REQUESTS_QUANT;
+ 		      lo->freebytes[offstart / 8]
+ 			&= ((1 << (8 - (start % 8))) - 1);
+-		      grub_memset (lo->freebytes + (offstart + 7) / 8, 0,
+-				   offend / 8 - (offstart + 7) / 8);
+-		      lo->freebytes[offend / 8] &= ~((1 << (offend % 8)) - 1);
++		      if (offend / 8 > (offstart + 7) / 8)
++			grub_memset (lo->freebytes + (offstart + 7) / 8, 0,
++				     offend / 8 - (offstart + 7) / 8);
++		      if (offend < GRUB_RELOCATOR_FIRMWARE_REQUESTS_QUANT)
++			lo->freebytes[offend / 8] &= ~((1 << (offend % 8)) - 1);
+ 		    }
+ 		    break;
+ #endif
+-- 
+cgit v1.1
+

_service:tar_scm:backport-util-grub-mount-Fix-memory-leak-in-fuse_getattr.patch Added

_service:tar_scm:grub.patches Changed

_service:tar_scm:grub2-1694155139.0793726.tar Deleted

_service:tar_scm:grub2-1694851307.2575f39.tar Added

_service:tar_scm:sbat.csv.in Changed

Changes of Revision 96