proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-08-17 03:42:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

net/dns: Don't read past the end of the string we're checking against

Browse Source 
I don't really understand what's going on here but fuzzing found
a bug where we read past the end of check_with. That's a C string,
so use grub_strlen() to make sure we don't overread it.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens 2021-12-20 21:55:43 +11:00 committed by Julian Andres Klode
parent 21158c5dfb
commit 968febf3a4
1 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
grub-core/net/dns.c
View File

@ -146,11 +146,18 @@ check_name_real (const grub_uint8_t *name_at, const grub_uint8_t *head,
int *length, char *set) int *length, char *set)
{ {
const char *readable_ptr = check_with; const char *readable_ptr = check_with;
int readable_len;
const grub_uint8_t *ptr; const grub_uint8_t *ptr;
char *optr = set; char *optr = set;
int bytes_processed = 0; int bytes_processed = 0;
if (length) if (length)
*length = 0; *length = 0;
if (readable_ptr != NULL)
readable_len = grub_strlen (readable_ptr);
else
readable_len = 0;
for (ptr = name_at; ptr < tail && bytes_processed < tail - head + 2; ) for (ptr = name_at; ptr < tail && bytes_processed < tail - head + 2; )
{ {
/* End marker. */ /* End marker. */
@ -172,13 +179,16 @@ check_name_real (const grub_uint8_t *name_at, const grub_uint8_t *head,
ptr = head + (((ptr[0] & 0x3f) << 8) | ptr[1]); ptr = head + (((ptr[0] & 0x3f) << 8) | ptr[1]);
continue; continue;
} }
if (readable_ptr && grub_memcmp (ptr + 1, readable_ptr, *ptr) != 0) if (readable_ptr != NULL && (*ptr > readable_len || grub_memcmp (ptr + 1, readable_ptr, *ptr) != 0))
return 0; return 0;
if (grub_memchr (ptr + 1, 0, *ptr) if (grub_memchr (ptr + 1, 0, *ptr)
|| grub_memchr (ptr + 1, '.', *ptr)) || grub_memchr (ptr + 1, '.', *ptr))
return 0; return 0;
if (readable_ptr) if (readable_ptr)
readable_ptr += *ptr; {
readable_ptr += *ptr;
readable_len -= *ptr;
}
if (readable_ptr && *readable_ptr != '.' && *readable_ptr != 0) if (readable_ptr && *readable_ptr != '.' && *readable_ptr != 0)
return 0; return 0;
bytes_processed += *ptr + 1; bytes_processed += *ptr + 1;
@ -192,7 +202,10 @@ check_name_real (const grub_uint8_t *name_at, const grub_uint8_t *head,
if (optr) if (optr)
*optr++ = '.'; *optr++ = '.';
if (readable_ptr && *readable_ptr) if (readable_ptr && *readable_ptr)
readable_ptr++; {
readable_ptr++;
readable_len--;
}
ptr += *ptr + 1; ptr += *ptr + 1;
} }
return 0; return 0;