proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-08-06 16:22:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

disk/lvm: Don't go beyond the end of the data we read from disk

Browse Source 
We unconditionally trusted offset_xl from the LVM label header, even if
it told us that the PV header/disk locations were way off past the end
of the data we read from disk.

Require that the offset be sane, fixing an OOB read and crash.

Fixes: CID 314367, CID 314371

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens 2021-01-21 17:59:14 +11:00 committed by Daniel Kiper
parent b5a2b59cc5
commit a8cc95de74
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
grub-core/disk/lvm.c
View File

@ -178,6 +178,20 @@ grub_lvm_detect (grub_disk_t disk,
goto fail;
}
/*
* We read a grub_lvm_pv_header and then 2 grub_lvm_disk_locns that
* immediately follow the PV header. Make sure we have space for both.
*/
if (grub_le_to_cpu32 (lh->offset_xl) >=
GRUB_LVM_LABEL_SIZE - sizeof (struct grub_lvm_pv_header) -
2 * sizeof (struct grub_lvm_disk_locn))
{
#ifdef GRUB_UTIL
grub_util_info ("LVM PV header/disk locations are beyond the end of the block");
#endif
goto fail;
}
pvh = (struct grub_lvm_pv_header *) (buf + grub_le_to_cpu32(lh->offset_xl));
for (i = 0, j = 0; i < GRUB_LVM_ID_LEN; i++)