proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-07-24 17:01:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

video/fb/video_fb: Fix multiple integer overflows

Browse Source 
The calculation of the unsigned 64-bit value is being generated by
multiplying 2, signed or unsigned, 32-bit integers which may overflow
before promotion to unsigned 64-bit. Fix all of them.

Fixes: CID 73703, CID 73767, CID 73833

Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Darren Kenny 2020-11-04 14:43:44 +00:00 committed by Daniel Kiper
parent 7ce3259f67
commit 08e098b1db
1 changed files with 36 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
grub-core/video/fb/video_fb.c
View File

@ -25,6 +25,7 @@
#include <grub/fbutil.h>
#include <grub/bitmap.h>
#include <grub/dl.h>
#include <grub/safemath.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -1417,15 +1418,23 @@ doublebuf_blit_update_screen (void)
{
if (framebuffer.current_dirty.first_line
<= framebuffer.current_dirty.last_line)
grub_memcpy ((char *) framebuffer.pages[0]
+ framebuffer.current_dirty.first_line
* framebuffer.back_target->mode_info.pitch,
(char *) framebuffer.back_target->data
+ framebuffer.current_dirty.first_line
* framebuffer.back_target->mode_info.pitch,
framebuffer.back_target->mode_info.pitch
* (framebuffer.current_dirty.last_line
- framebuffer.current_dirty.first_line));
{
grub_size_t copy_size;
if (grub_sub (framebuffer.current_dirty.last_line,
framebuffer.current_dirty.first_line, &copy_size) ||
grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, &copy_size))
{
/* Shouldn't happen, but if it does we've a bug. */
return GRUB_ERR_BUG;
}
grub_memcpy ((char *) framebuffer.pages[0] + framebuffer.current_dirty.first_line *
framebuffer.back_target->mode_info.pitch,
(char *) framebuffer.back_target->data + framebuffer.current_dirty.first_line *
framebuffer.back_target->mode_info.pitch,
copy_size);
}
framebuffer.current_dirty.first_line
= framebuffer.back_target->mode_info.height;
framebuffer.current_dirty.last_line = 0;
@ -1439,7 +1448,7 @@ grub_video_fb_doublebuf_blit_init (struct grub_video_fbrender_target **back,
volatile void *framebuf)
{
grub_err_t err;
grub_size_t page_size = mode_info.pitch * mode_info.height;
grub_size_t page_size = (grub_size_t) mode_info.pitch * mode_info.height;
framebuffer.offscreen_buffer = grub_zalloc (page_size);
if (! framebuffer.offscreen_buffer)
@ -1482,12 +1491,23 @@ doublebuf_pageflipping_update_screen (void)
last_line = framebuffer.previous_dirty.last_line;
if (first_line <= last_line)
grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page]
+ first_line * framebuffer.back_target->mode_info.pitch,
(char *) framebuffer.back_target->data
+ first_line * framebuffer.back_target->mode_info.pitch,
framebuffer.back_target->mode_info.pitch
* (last_line - first_line));
{
grub_size_t copy_size;
if (grub_sub (last_line, first_line, &copy_size) ||
grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, &copy_size))
{
/* Shouldn't happen, but if it does we've a bug. */
return GRUB_ERR_BUG;
}
grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page] + first_line *
framebuffer.back_target->mode_info.pitch,
(char *) framebuffer.back_target->data + first_line *
framebuffer.back_target->mode_info.pitch,
copy_size);
}
framebuffer.previous_dirty = framebuffer.current_dirty;
framebuffer.current_dirty.first_line
= framebuffer.back_target->mode_info.height;