proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-08-05 11:34:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

gnulib/regexec: Fix possible null-dereference

Browse Source 
It appears to be possible that the mctx->state_log field may be NULL,
and the name of this function, clean_state_log_if_needed(), suggests
that it should be checking that it is valid to be cleaned before
assuming that it does.

Fixes: CID 86720

Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Darren Kenny 2020-11-05 10:57:14 +00:00 committed by Daniel Kiper
parent 3a37bf120a
commit 0b7f347638
3 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
bootstrap.conf
View File

@ -79,7 +79,8 @@ cp -a INSTALL INSTALL.grub
bootstrap_post_import_hook () {
set -e
for patchname in fix-base64 fix-null-deref fix-null-state-deref fix-uninit-structure fix-unused-value fix-width no-abort; do
for patchname in fix-base64 fix-null-deref fix-null-state-deref fix-regexec-null-deref \
fix-uninit-structure fix-unused-value fix-width no-abort; do
patch -d grub-core/lib/gnulib -p2 \
< "grub-core/lib/gnulib-patches/$patchname.patch"
done

1
conf/Makefile.extra-dist
View File

@ -31,6 +31,7 @@ EXTRA_DIST += grub-core/genemuinitheader.sh
EXTRA_DIST += grub-core/lib/gnulib-patches/fix-base64.patch
EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-deref.patch
EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-state-deref.patch
EXTRA_DIST += grub-core/lib/gnulib-patches/fix-regexec-null-deref.patch
EXTRA_DIST += grub-core/lib/gnulib-patches/fix-uninit-structure.patch
EXTRA_DIST += grub-core/lib/gnulib-patches/fix-unused-value.patch
EXTRA_DIST += grub-core/lib/gnulib-patches/fix-width.patch

12
grub-core/lib/gnulib-patches/fix-regexec-null-deref.patch Normal file
View File

@ -0,0 +1,12 @@
--- a/lib/regexec.c 2020-10-21 14:25:35.310195912 +0000
+++ b/lib/regexec.c 2020-11-05 10:55:09.621542984 +0000
@@ -1692,6 +1692,9 @@
{
Idx top = mctx->state_log_top;
+ if (mctx->state_log == NULL)
+ return REG_NOERROR;
+
if ((next_state_log_idx >= mctx->input.bufs_len
&& mctx->input.bufs_len < mctx->input.len)
|| (next_state_log_idx >= mctx->input.valid_len