pool/grub2
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 823469 from home:michael-chang:branches:Base:System

Browse Source 
- Fix for CVE-2020-10713 (bsc#1168994)
  * 0001-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch
- Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311
  (bsc#1173812)
  * 0002-safemath-Add-some-arithmetic-primitives-that-check-f.patch
  * 0003-calloc-Make-sure-we-always-have-an-overflow-checking.patch
  * 0004-calloc-Use-calloc-at-most-places.patch
  * 0005-malloc-Use-overflow-checking-primitives-where-we-do-.patch
  * 0006-iso9660-Don-t-leak-memory-on-realloc-failures.patch
  * 0007-font-Do-not-load-more-than-one-NAME-section.patch
- Fix CVE-2020-15706 (bsc#1174463)
  * 0008-script-Remove-unused-fields-from-grub_script_functio.patch
  * 0009-script-Avoid-a-use-after-free-when-redefining-a-func.patch
- Fix CVE-2020-15707 (bsc#1174570)
  * 0010-linux-Fix-integer-overflows-in-initrd-size-handling.patch
- Use overflow checking primitives where the arithmetic expression for buffer
  allocations may include unvalidated data
- Use grub_calloc for overflow check and return NULL when it would occur 
  * 0001-add-support-for-UEFI-network-protocols.patch
  * 0003-bootp-New-net_bootp6-command.patch
  * grub2-btrfs-01-add-ability-to-boot-from-subvolumes.patch
  * grub2-btrfs-09-get-default-subvolume.patch
  * grub2-gfxmenu-support-scrolling-menu-entry-s-text.patch
  * grub2-grubenv-in-btrfs-header.patch

OBS-URL: https://build.opensuse.org/request/show/823469
OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=358
This commit is contained in:
Michael Chang 2020-07-30 01:36:35 +00:00 committed by Git OBS Bridge
parent 1f1692c67a
commit 1f5e046570
18 changed files with 4272 additions and 143 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

143
0001-add-support-for-UEFI-network-protocols.patch
View File

@ -23,10 +23,16 @@ V3:
* Finish HTTP transaction in one go * Finish HTTP transaction in one go
* Fix bsc#1076132 * Fix bsc#1076132
V4 V4:
* Add fs_ prefix with upstream commit * Add fs_ prefix with upstream commit
ad4bfeec5 Change fs functions to add fs_ prefix ad4bfeec5 Change fs functions to add fs_ prefix
V5:
* Use overflow checking primitives where the arithmetic expression for
buffer allocations may include unvalidated data
* Use grub_calloc for overflow check and return NULL when it would
occur.
--- ---
grub-core/Makefile.core.def | 18 + grub-core/Makefile.core.def | 18 +
grub-core/io/bufio.c | 2 +- grub-core/io/bufio.c | 2 +-
@ -57,10 +63,10 @@ V4
create mode 100644 include/grub/efi/http.h create mode 100644 include/grub/efi/http.h
create mode 100644 include/grub/net/efi.h create mode 100644 include/grub/net/efi.h
Index: grub-2.04~rc1/grub-core/Makefile.core.def Index: grub-2.04/grub-core/Makefile.core.def
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/Makefile.core.def --- grub-2.04.orig/grub-core/Makefile.core.def
+++ grub-2.04~rc1/grub-core/Makefile.core.def +++ grub-2.04/grub-core/Makefile.core.def
@@ -1854,7 +1854,6 @@ module = { @@ -1854,7 +1854,6 @@ module = {
module = { module = {
name = linuxefi; name = linuxefi;
@ -82,10 +88,10 @@ Index: grub-2.04~rc1/grub-core/Makefile.core.def
}; };
module = { module = {
Index: grub-2.04~rc1/grub-core/io/bufio.c Index: grub-2.04/grub-core/io/bufio.c
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/io/bufio.c --- grub-2.04.orig/grub-core/io/bufio.c
+++ grub-2.04~rc1/grub-core/io/bufio.c +++ grub-2.04/grub-core/io/bufio.c
@@ -139,7 +139,7 @@ grub_bufio_read (grub_file_t file, char @@ -139,7 +139,7 @@ grub_bufio_read (grub_file_t file, char
return res; return res;
@ -95,10 +101,10 @@ Index: grub-2.04~rc1/grub-core/io/bufio.c
/* Now read between file->offset + res and bufio->buffer_at. */ /* Now read between file->offset + res and bufio->buffer_at. */
if (file->offset + res < next_buf) if (file->offset + res < next_buf)
{ {
Index: grub-2.04~rc1/grub-core/kern/efi/efi.c Index: grub-2.04/grub-core/kern/efi/efi.c
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/kern/efi/efi.c --- grub-2.04.orig/grub-core/kern/efi/efi.c
+++ grub-2.04~rc1/grub-core/kern/efi/efi.c +++ grub-2.04/grub-core/kern/efi/efi.c
@@ -722,7 +722,7 @@ grub_efi_print_device_path (grub_efi_dev @@ -722,7 +722,7 @@ grub_efi_print_device_path (grub_efi_dev
{ {
grub_efi_ipv4_device_path_t *ipv4 grub_efi_ipv4_device_path_t *ipv4
@ -226,10 +232,10 @@ Index: grub-2.04~rc1/grub-core/kern/efi/efi.c
default: default:
grub_printf ("/UnknownMessaging(%x)", (unsigned) subtype); grub_printf ("/UnknownMessaging(%x)", (unsigned) subtype);
break; break;
Index: grub-2.04~rc1/grub-core/net/drivers/efi/efinet.c Index: grub-2.04/grub-core/net/drivers/efi/efinet.c
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/net/drivers/efi/efinet.c --- grub-2.04.orig/grub-core/net/drivers/efi/efinet.c
+++ grub-2.04~rc1/grub-core/net/drivers/efi/efinet.c +++ grub-2.04/grub-core/net/drivers/efi/efinet.c
@@ -24,6 +24,7 @@ @@ -24,6 +24,7 @@
#include <grub/efi/efi.h> #include <grub/efi/efi.h>
#include <grub/i18n.h> #include <grub/i18n.h>
@ -298,11 +304,11 @@ Index: grub-2.04~rc1/grub-core/net/drivers/efi/efinet.c
+ grub_efi_net_config = NULL; + grub_efi_net_config = NULL;
} }
Index: grub-2.04~rc1/grub-core/net/efi/dhcp.c Index: grub-2.04/grub-core/net/efi/dhcp.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/grub-core/net/efi/dhcp.c +++ grub-2.04/grub-core/net/efi/dhcp.c
@@ -0,0 +1,397 @@ @@ -0,0 +1,399 @@
+#include <grub/mm.h> +#include <grub/mm.h>
+#include <grub/command.h> +#include <grub/command.h>
+#include <grub/efi/api.h> +#include <grub/efi/api.h>
@ -385,7 +391,7 @@ Index: grub-2.04~rc1/grub-core/net/efi/dhcp.c
+ if (status != GRUB_EFI_BUFFER_TOO_SMALL) + if (status != GRUB_EFI_BUFFER_TOO_SMALL)
+ return NULL; + return NULL;
+ +
+ option_list = grub_malloc (option_count * sizeof(*option_list)); + option_list = grub_calloc (option_count, sizeof(*option_list));
+ if (!option_list) + if (!option_list)
+ return NULL; + return NULL;
+ +
@ -665,7 +671,9 @@ Index: grub-2.04~rc1/grub-core/net/efi/dhcp.c
+ +
+ if (status == GRUB_EFI_BUFFER_TOO_SMALL && count) + if (status == GRUB_EFI_BUFFER_TOO_SMALL && count)
+ { + {
+ options = grub_malloc (count * sizeof(*options)); + options = grub_calloc (count, sizeof(*options));
+ if (!options)
+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+ status = efi_call_4 (dev->dhcp6->parse, dev->dhcp6, mode.ia->reply_packet, &count, options); + status = efi_call_4 (dev->dhcp6->parse, dev->dhcp6, mode.ia->reply_packet, &count, options);
+ } + }
+ +
@ -700,17 +708,18 @@ Index: grub-2.04~rc1/grub-core/net/efi/dhcp.c
+ +
+grub_command_func_t grub_efi_net_bootp = grub_cmd_efi_bootp; +grub_command_func_t grub_efi_net_bootp = grub_cmd_efi_bootp;
+grub_command_func_t grub_efi_net_bootp6 = grub_cmd_efi_bootp6; +grub_command_func_t grub_efi_net_bootp6 = grub_cmd_efi_bootp6;
Index: grub-2.04~rc1/grub-core/net/efi/http.c Index: grub-2.04/grub-core/net/efi/http.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/grub-core/net/efi/http.c +++ grub-2.04/grub-core/net/efi/http.c
@@ -0,0 +1,419 @@ @@ -0,0 +1,424 @@
+ +
+#include <grub/efi/api.h> +#include <grub/efi/api.h>
+#include <grub/efi/efi.h> +#include <grub/efi/efi.h>
+#include <grub/misc.h> +#include <grub/misc.h>
+#include <grub/net/efi.h> +#include <grub/net/efi.h>
+#include <grub/charset.h> +#include <grub/charset.h>
+#include <grub/safemath.h>
+ +
+static void +static void
+http_configure (struct grub_efi_net_device *dev, int prefer_ip6) +http_configure (struct grub_efi_net_device *dev, int prefer_ip6)
@ -835,6 +844,7 @@ Index: grub-2.04~rc1/grub-core/net/efi/http.c
+ grub_efi_char16_t *ucs2_url; + grub_efi_char16_t *ucs2_url;
+ grub_size_t url_len, ucs2_url_len; + grub_size_t url_len, ucs2_url_len;
+ const char *protocol = (use_https == 1) ? "https" : "http"; + const char *protocol = (use_https == 1) ? "https" : "http";
+ grub_size_t sz;
+ +
+ if (grub_efi_string_to_ip6_address (server, &address, &rest) && *rest == 0) + if (grub_efi_string_to_ip6_address (server, &address, &rest) && *rest == 0)
+ url = grub_xasprintf ("%s://[%s]%s", protocol, server, name); + url = grub_xasprintf ("%s://[%s]%s", protocol, server, name);
@ -847,8 +857,11 @@ Index: grub-2.04~rc1/grub-core/net/efi/http.c
+ } + }
+ +
+ url_len = grub_strlen (url); + url_len = grub_strlen (url);
+ ucs2_url_len = url_len * GRUB_MAX_UTF16_PER_UTF8; + if (grub_mul (url_len, GRUB_MAX_UTF16_PER_UTF8, &ucs2_url_len) ||
+ ucs2_url = grub_malloc ((ucs2_url_len + 1) * sizeof (ucs2_url[0])); + grub_add (ucs2_url_len, 1, &sz))
+ return GRUB_ERR_OUT_OF_RANGE;
+
+ ucs2_url = grub_calloc (sz, sizeof (ucs2_url[0]));
+ +
+ if (!ucs2_url) + if (!ucs2_url)
+ { + {
@ -1124,26 +1137,30 @@ Index: grub-2.04~rc1/grub-core/net/efi/http.c
+ .read = grub_efihttp_read, + .read = grub_efihttp_read,
+ .close = grub_efihttp_close + .close = grub_efihttp_close
+ }; + };
Index: grub-2.04~rc1/grub-core/net/efi/ip4_config.c Index: grub-2.04/grub-core/net/efi/ip4_config.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/grub-core/net/efi/ip4_config.c +++ grub-2.04/grub-core/net/efi/ip4_config.c
@@ -0,0 +1,398 @@ @@ -0,0 +1,409 @@
+ +
+#include <grub/efi/api.h> +#include <grub/efi/api.h>
+#include <grub/efi/efi.h> +#include <grub/efi/efi.h>
+#include <grub/misc.h> +#include <grub/misc.h>
+#include <grub/net/efi.h> +#include <grub/net/efi.h>
+#include <grub/charset.h> +#include <grub/charset.h>
+#include <grub/safemath.h>
+ +
+char * +char *
+grub_efi_hw_address_to_string (grub_efi_uint32_t hw_address_size, grub_efi_mac_address_t hw_address) +grub_efi_hw_address_to_string (grub_efi_uint32_t hw_address_size, grub_efi_mac_address_t hw_address)
+{ +{
+ char *hw_addr, *p; + char *hw_addr, *p;
+ int sz, s; + int s;
+ int i; + int i;
+ grub_size_t sz;
+ +
+ sz = (int)hw_address_size * (sizeof ("XX:") - 1) + 1; + if (grub_mul (hw_address_size, sizeof ("XX:") - 1, &sz) ||
+ grub_add (sz, 1, &sz))
+ return NULL;
+ +
+ hw_addr = grub_malloc (sz); + hw_addr = grub_malloc (sz);
+ if (!hw_addr) + if (!hw_addr)
@ -1359,12 +1376,19 @@ Index: grub-2.04~rc1/grub-core/net/efi/ip4_config.c
+ grub_efi_ip4_config2_interface_info_t *interface_info; + grub_efi_ip4_config2_interface_info_t *interface_info;
+ char **ret; + char **ret;
+ int i, id; + int i, id;
+ grub_size_t sz;
+ +
+ interface_info = efi_ip4_config_interface_info (dev->ip4_config); + interface_info = efi_ip4_config_interface_info (dev->ip4_config);
+ if (!interface_info) + if (!interface_info)
+ return NULL; + return NULL;
+ +
+ ret = grub_malloc (sizeof (*ret) * (interface_info->route_table_size + 1)); + if (grub_add (interface_info->route_table_size, 1, &sz))
+ {
+ grub_free (interface_info);
+ return NULL;
+ }
+
+ ret = grub_calloc (sz, sizeof (*ret));
+ +
+ if (!ret) + if (!ret)
+ { + {
@ -1527,16 +1551,17 @@ Index: grub-2.04~rc1/grub-core/net/efi/ip4_config.c
+ .set_gateway = grub_efi_ip4_interface_set_gateway, + .set_gateway = grub_efi_ip4_interface_set_gateway,
+ .set_dns = grub_efi_ip4_interface_set_dns + .set_dns = grub_efi_ip4_interface_set_dns
+ }; + };
Index: grub-2.04~rc1/grub-core/net/efi/ip6_config.c Index: grub-2.04/grub-core/net/efi/ip6_config.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/grub-core/net/efi/ip6_config.c +++ grub-2.04/grub-core/net/efi/ip6_config.c
@@ -0,0 +1,422 @@ @@ -0,0 +1,430 @@
+#include <grub/efi/api.h> +#include <grub/efi/api.h>
+#include <grub/efi/efi.h> +#include <grub/efi/efi.h>
+#include <grub/misc.h> +#include <grub/misc.h>
+#include <grub/net/efi.h> +#include <grub/net/efi.h>
+#include <grub/charset.h> +#include <grub/charset.h>
+#include <grub/safemath.h>
+ +
+char * +char *
+grub_efi_ip6_address_to_string (grub_efi_pxe_ipv6_address_t *address) +grub_efi_ip6_address_to_string (grub_efi_pxe_ipv6_address_t *address)
@ -1763,12 +1788,19 @@ Index: grub-2.04~rc1/grub-core/net/efi/ip6_config.c
+ grub_efi_ip6_config_interface_info_t *interface_info; + grub_efi_ip6_config_interface_info_t *interface_info;
+ char **ret; + char **ret;
+ int i, id; + int i, id;
+ grub_size_t sz;
+ +
+ interface_info = efi_ip6_config_interface_info (dev->ip6_config); + interface_info = efi_ip6_config_interface_info (dev->ip6_config);
+ if (!interface_info) + if (!interface_info)
+ return NULL; + return NULL;
+ +
+ ret = grub_malloc (sizeof (*ret) * (interface_info->route_count + 1)); + if (grub_add (interface_info->route_count, 1, &sz))
+ {
+ grub_free (interface_info);
+ return NULL;
+ }
+
+ ret = grub_calloc (sz, sizeof (*ret));
+ +
+ if (!ret) + if (!ret)
+ { + {
@ -1954,11 +1986,11 @@ Index: grub-2.04~rc1/grub-core/net/efi/ip6_config.c
+ .set_gateway = grub_efi_ip6_interface_set_gateway, + .set_gateway = grub_efi_ip6_interface_set_gateway,
+ .set_dns = grub_efi_ip6_interface_set_dns + .set_dns = grub_efi_ip6_interface_set_dns
+ }; + };
Index: grub-2.04~rc1/grub-core/net/efi/net.c Index: grub-2.04/grub-core/net/efi/net.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/grub-core/net/efi/net.c +++ grub-2.04/grub-core/net/efi/net.c
@@ -0,0 +1,1428 @@ @@ -0,0 +1,1437 @@
+#include <grub/net.h> +#include <grub/net.h>
+#include <grub/env.h> +#include <grub/env.h>
+#include <grub/mm.h> +#include <grub/mm.h>
@ -1973,6 +2005,7 @@ Index: grub-2.04~rc1/grub-core/net/efi/net.c
+#include <grub/efi/dhcp.h> +#include <grub/efi/dhcp.h>
+#include <grub/net/efi.h> +#include <grub/net/efi.h>
+#include <grub/charset.h> +#include <grub/charset.h>
+#include <grub/safemath.h>
+ +
+GRUB_MOD_LICENSE ("GPLv3+"); +GRUB_MOD_LICENSE ("GPLv3+");
+ +
@ -2198,7 +2231,15 @@ Index: grub-2.04~rc1/grub-core/net/efi/net.c
+ +
+ if (code == GRUB_NET_DHCP6_OPTION_BOOTFILE_URL) + if (code == GRUB_NET_DHCP6_OPTION_BOOTFILE_URL)
+ { + {
+ char *url = grub_malloc (len + 1); + char *url;
+ grub_size_t sz;
+
+ if (grub_add (len, 1, &sz))
+ return;
+
+ url = grub_malloc (sz);
+ if (!url)
+ return;
+ +
+ grub_memcpy (url, dhcp_opt->data, len); + grub_memcpy (url, dhcp_opt->data, len);
+ url[len] = 0; + url[len] = 0;
@ -3387,10 +3428,10 @@ Index: grub-2.04~rc1/grub-core/net/efi/net.c
+ grub_net_open = NULL; + grub_net_open = NULL;
+ grub_fs_unregister (&grub_efi_netfs); + grub_fs_unregister (&grub_efi_netfs);
+} +}
Index: grub-2.04~rc1/grub-core/net/efi/pxe.c Index: grub-2.04/grub-core/net/efi/pxe.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/grub-core/net/efi/pxe.c +++ grub-2.04/grub-core/net/efi/pxe.c
@@ -0,0 +1,424 @@ @@ -0,0 +1,424 @@
+ +
+#include <grub/efi/api.h> +#include <grub/efi/api.h>
@ -3816,10 +3857,10 @@ Index: grub-2.04~rc1/grub-core/net/efi/pxe.c
+ .close = pxe_close + .close = pxe_close
+ }; + };
+ +
Index: grub-2.04~rc1/grub-core/net/net.c Index: grub-2.04/grub-core/net/net.c
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/net/net.c --- grub-2.04.orig/grub-core/net/net.c
+++ grub-2.04~rc1/grub-core/net/net.c +++ grub-2.04/grub-core/net/net.c
@@ -32,6 +32,9 @@ @@ -32,6 +32,9 @@
#include <grub/loader.h> #include <grub/loader.h>
#include <grub/bufio.h> #include <grub/bufio.h>
@ -3926,10 +3967,10 @@ Index: grub-2.04~rc1/grub-core/net/net.c
+ init_mode = INIT_MODE_NONE; + init_mode = INIT_MODE_NONE;
+#endif +#endif
} }
Index: grub-2.04~rc1/include/grub/efi/api.h Index: grub-2.04/include/grub/efi/api.h
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/include/grub/efi/api.h --- grub-2.04.orig/include/grub/efi/api.h
+++ grub-2.04~rc1/include/grub/efi/api.h +++ grub-2.04/include/grub/efi/api.h
@@ -588,6 +588,23 @@ typedef grub_uint16_t grub_efi_ipv6_addr @@ -588,6 +588,23 @@ typedef grub_uint16_t grub_efi_ipv6_addr
typedef grub_uint8_t grub_efi_ip_address_t[8] __attribute__ ((aligned(4))); typedef grub_uint8_t grub_efi_ip_address_t[8] __attribute__ ((aligned(4)));
typedef grub_efi_uint64_t grub_efi_physical_address_t; typedef grub_efi_uint64_t grub_efi_physical_address_t;
@ -4177,10 +4218,10 @@ Index: grub-2.04~rc1/include/grub/efi/api.h
#if (GRUB_TARGET_SIZEOF_VOID_P == 4) || defined (__ia64__) \ #if (GRUB_TARGET_SIZEOF_VOID_P == 4) || defined (__ia64__) \
|| defined (__aarch64__) || defined (__MINGW64__) || defined (__CYGWIN__) \ || defined (__aarch64__) || defined (__MINGW64__) || defined (__CYGWIN__) \
|| defined(__riscv) || defined(__riscv)
Index: grub-2.04~rc1/include/grub/efi/dhcp.h Index: grub-2.04/include/grub/efi/dhcp.h
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/include/grub/efi/dhcp.h +++ grub-2.04/include/grub/efi/dhcp.h
@@ -0,0 +1,343 @@ @@ -0,0 +1,343 @@
+#ifndef GRUB_EFI_DHCP_HEADER +#ifndef GRUB_EFI_DHCP_HEADER
+#define GRUB_EFI_DHCP_HEADER 1 +#define GRUB_EFI_DHCP_HEADER 1
@ -4525,10 +4566,10 @@ Index: grub-2.04~rc1/include/grub/efi/dhcp.h
+}; +};
+ +
+#endif /* ! GRUB_EFI_DHCP_HEADER */ +#endif /* ! GRUB_EFI_DHCP_HEADER */
Index: grub-2.04~rc1/include/grub/efi/http.h Index: grub-2.04/include/grub/efi/http.h
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/include/grub/efi/http.h +++ grub-2.04/include/grub/efi/http.h
@@ -0,0 +1,215 @@ @@ -0,0 +1,215 @@
+/* +/*
+ * GRUB -- GRand Unified Bootloader + * GRUB -- GRand Unified Bootloader
@ -4745,10 +4786,10 @@ Index: grub-2.04~rc1/include/grub/efi/http.h
+typedef struct grub_efi_http grub_efi_http_t; +typedef struct grub_efi_http grub_efi_http_t;
+ +
+#endif /* !GRUB_EFI_HTTP_HEADER */ +#endif /* !GRUB_EFI_HTTP_HEADER */
Index: grub-2.04~rc1/include/grub/net/efi.h Index: grub-2.04/include/grub/net/efi.h
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ grub-2.04~rc1/include/grub/net/efi.h +++ grub-2.04/include/grub/net/efi.h
@@ -0,0 +1,144 @@ @@ -0,0 +1,144 @@
+#ifndef GRUB_NET_EFI_HEADER +#ifndef GRUB_NET_EFI_HEADER
+#define GRUB_NET_EFI_HEADER 1 +#define GRUB_NET_EFI_HEADER 1

67
0001-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch Normal file
View File

@ -0,0 +1,67 @@
From a948ac01744f3490fa5af4b38039f7dade68bb3e Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Wed, 15 Apr 2020 15:45:02 -0400
Subject: [PATCH EMBARGOED CVE-2020-10713] yylex: Make lexer fatal errors
actually be fatal
When presented with a command that can't be tokenized to anything
smaller than YYLMAX characters, the parser calls YY_FATAL_ERROR(errmsg),
expecting that will stop further processing, as such:
#define YY_DO_BEFORE_ACTION \
yyg->yytext_ptr = yy_bp; \
yyleng = (int) (yy_cp - yy_bp); \
yyg->yy_hold_char = *yy_cp; \
*yy_cp = '\0'; \
if ( yyleng >= YYLMAX ) \
YY_FATAL_ERROR( "token too large, exceeds YYLMAX" ); \
yy_flex_strncpy( yytext, yyg->yytext_ptr, yyleng + 1 , yyscanner); \
yyg->yy_c_buf_p = yy_cp;
The code flex generates expects that YY_FATAL_ERROR() will either return
for it or do some form of longjmp(), or handle the error in some way at
least, and so the strncpy() call isn't in an "else" clause, and thus if
YY_FATAL_ERROR() is *not* actually fatal, it does the call with the
questionable limit, and predictable results ensue.
Unfortunately, our implementation of YY_FATAL_ERROR() is:
#define YY_FATAL_ERROR(msg) \
do { \
grub_printf (_("fatal error: %s\n"), _(msg)); \
} while (0)
The same pattern exists in yyless(), and similar problems exist in users
of YY_INPUT(), several places in the main parsing loop,
yy_get_next_buffer(), yy_load_buffer_state(), yyensure_buffer_stack,
yy_scan_buffer(), etc.
All of these callers expect YY_FATAL_ERROR() to actually be fatal, and
the things they do if it returns after calling it are wildly unsafe.
Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
grub-core/script/yylex.l | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/grub-core/script/yylex.l b/grub-core/script/yylex.l
index 7b44c37b7..b7203c823 100644
--- a/grub-core/script/yylex.l
+++ b/grub-core/script/yylex.l
@@ -37,11 +37,11 @@
/*
* As we don't have access to yyscanner, we cannot do much except to
- * print the fatal error.
+ * print the fatal error and exit.
*/
#define YY_FATAL_ERROR(msg) \
do { \
- grub_printf (_("fatal error: %s\n"), _(msg)); \
+ grub_fatal (_("fatal error: %s\n"), _(msg));\
} while (0)
#define COPY(str, hint) \
--
2.11.0

123
0002-safemath-Add-some-arithmetic-primitives-that-check-f.patch Normal file
View File

@ -0,0 +1,123 @@
From de1c315841aa6f37357c72e196810484013291d6 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Mon, 15 Jun 2020 10:58:42 -0400
Subject: [PATCH 2/7] safemath: Add some arithmetic primitives that check for
overflow
This adds a new header, include/grub/safemath.h, that includes easy to
use wrappers for __builtin_{add,sub,mul}_overflow() declared like:
bool OP(a, b, res)
where OP is grub_add, grub_sub or grub_mul. OP() returns true in the
case where the operation would overflow and res is not modified.
Otherwise, false is returned and the operation is executed.
These arithmetic primitives require newer compiler versions. So, bump
these requirements in the INSTALL file too.
Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
INSTALL | 22 ++--------------------
include/grub/compiler.h | 8 ++++++++
include/grub/safemath.h | 37 +++++++++++++++++++++++++++++++++++++
3 files changed, 47 insertions(+), 20 deletions(-)
create mode 100644 include/grub/safemath.h
diff --git a/INSTALL b/INSTALL
index dedf236a8..79a0af7d9 100644
--- a/INSTALL
+++ b/INSTALL
@@ -11,27 +11,9 @@ GRUB depends on some software packages installed into your system. If
you don't have any of them, please obtain and install them before
configuring the GRUB.
-* GCC 4.1.3 or later
- Note: older versions may work but support is limited
-
- Experimental support for clang 3.3 or later (results in much bigger binaries)
+* GCC 5.1.0 or later
+ Experimental support for clang 3.8.0 or later (results in much bigger binaries)
for i386, x86_64, arm (including thumb), arm64, mips(el), powerpc, sparc64
- Note: clang 3.2 or later works for i386 and x86_64 targets but results in
- much bigger binaries.
- earlier versions not tested
- Note: clang 3.2 or later works for arm
- earlier versions not tested
- Note: clang on arm64 is not supported due to
- https://llvm.org/bugs/show_bug.cgi?id=26030
- Note: clang 3.3 or later works for mips(el)
- earlier versions fail to generate .reginfo and hence gprel relocations
- fail.
- Note: clang 3.2 or later works for powerpc
- earlier versions not tested
- Note: clang 3.5 or later works for sparc64
- earlier versions return "error: unable to interface with target machine"
- Note: clang has no support for ia64 and hence you can't compile GRUB
- for ia64 with clang
* GNU Make
* GNU Bison 2.3 or later
* GNU gettext 0.17 or later
diff --git a/include/grub/compiler.h b/include/grub/compiler.h
index c9e1d7a73..8f3be3ae7 100644
--- a/include/grub/compiler.h
+++ b/include/grub/compiler.h
@@ -48,4 +48,12 @@
# define WARN_UNUSED_RESULT
#endif
+#if defined(__clang__) && defined(__clang_major__) && defined(__clang_minor__)
+# define CLANG_PREREQ(maj,min) \
+ ((__clang_major__ > (maj)) || \
+ (__clang_major__ == (maj) && __clang_minor__ >= (min)))
+#else
+# define CLANG_PREREQ(maj,min) 0
+#endif
+
#endif /* ! GRUB_COMPILER_HEADER */
diff --git a/include/grub/safemath.h b/include/grub/safemath.h
new file mode 100644
index 000000000..c17b89bba
--- /dev/null
+++ b/include/grub/safemath.h
@@ -0,0 +1,37 @@
+/*
+ * GRUB -- GRand Unified Bootloader
+ * Copyright (C) 2020 Free Software Foundation, Inc.
+ *
+ * GRUB is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GRUB is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Arithmetic operations that protect against overflow.
+ */
+
+#ifndef GRUB_SAFEMATH_H
+#define GRUB_SAFEMATH_H 1
+
+#include <grub/compiler.h>
+
+/* These appear in gcc 5.1 and clang 3.8. */
+#if GNUC_PREREQ(5, 1) || CLANG_PREREQ(3, 8)
+
+#define grub_add(a, b, res) __builtin_add_overflow(a, b, res)
+#define grub_sub(a, b, res) __builtin_sub_overflow(a, b, res)
+#define grub_mul(a, b, res) __builtin_mul_overflow(a, b, res)
+
+#else
+#error gcc 5.1 or newer or clang 3.8 or newer is required
+#endif
+
+#endif /* GRUB_SAFEMATH_H */
--
2.27.0

25
0003-bootp-New-net_bootp6-command.patch
View File

@ -8,16 +8,21 @@ DHCPv6 protocol (RFC3315).
Signed-off-by: Michael Chang <mchang@suse.com> Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Ken Lin <ken.lin@hpe.com> Signed-off-by: Ken Lin <ken.lin@hpe.com>
V1:
* Use grub_calloc for overflow check and return NULL when it would
occur.
--- ---
grub-core/net/bootp.c | 908 +++++++++++++++++++++++++++++++++++++++++++++++++- grub-core/net/bootp.c | 908 +++++++++++++++++++++++++++++++++++++++++++++++++-
grub-core/net/ip.c | 39 +++ grub-core/net/ip.c | 39 +++
include/grub/net.h | 72 ++++ include/grub/net.h | 72 ++++
3 files changed, 1018 insertions(+), 1 deletion(-) 3 files changed, 1018 insertions(+), 1 deletion(-)
Index: grub-2.04~rc1/grub-core/net/bootp.c Index: grub-2.04/grub-core/net/bootp.c
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/net/bootp.c --- grub-2.04.orig/grub-core/net/bootp.c
+++ grub-2.04~rc1/grub-core/net/bootp.c +++ grub-2.04/grub-core/net/bootp.c
@@ -24,6 +24,98 @@ @@ -24,6 +24,98 @@
#include <grub/net/netbuff.h> #include <grub/net/netbuff.h>
#include <grub/net/udp.h> #include <grub/net/udp.h>
@ -265,7 +270,7 @@ Index: grub-2.04~rc1/grub-core/net/bootp.c
+ break; + break;
+ } + }
+ dhcp6->num_dns_server = ln = len >> 4; + dhcp6->num_dns_server = ln = len >> 4;
+ dhcp6->dns_server_addrs = la = grub_zalloc (ln * sizeof (*la)); + dhcp6->dns_server_addrs = la = grub_calloc (ln, sizeof (*la));
+ +
+ for (po = opt->data; ln > 0; po += 0x10, la++, ln--) + for (po = opt->data; ln > 0; po += 0x10, la++, ln--)
+ { + {
@ -966,10 +971,10 @@ Index: grub-2.04~rc1/grub-core/net/bootp.c
grub_unregister_command (cmd_dhcp); grub_unregister_command (cmd_dhcp);
+ grub_unregister_command (cmd_bootp6); + grub_unregister_command (cmd_bootp6);
} }
Index: grub-2.04~rc1/grub-core/net/ip.c Index: grub-2.04/grub-core/net/ip.c
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/net/ip.c --- grub-2.04.orig/grub-core/net/ip.c
+++ grub-2.04~rc1/grub-core/net/ip.c +++ grub-2.04/grub-core/net/ip.c
@@ -239,6 +239,45 @@ handle_dgram (struct grub_net_buff *nb, @@ -239,6 +239,45 @@ handle_dgram (struct grub_net_buff *nb,
{ {
struct udphdr *udph; struct udphdr *udph;
@ -1016,10 +1021,10 @@ Index: grub-2.04~rc1/grub-core/net/ip.c
if (proto == GRUB_NET_IP_UDP && grub_be_to_cpu16 (udph->dst) == 68) if (proto == GRUB_NET_IP_UDP && grub_be_to_cpu16 (udph->dst) == 68)
{ {
const struct grub_net_bootp_packet *bootp; const struct grub_net_bootp_packet *bootp;
Index: grub-2.04~rc1/include/grub/net.h Index: grub-2.04/include/grub/net.h
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/include/grub/net.h --- grub-2.04.orig/include/grub/net.h
+++ grub-2.04~rc1/include/grub/net.h +++ grub-2.04/include/grub/net.h
@@ -448,6 +448,66 @@ struct grub_net_bootp_packet @@ -448,6 +448,66 @@ struct grub_net_bootp_packet
grub_uint8_t vendor[0]; grub_uint8_t vendor[0];
} GRUB_PACKED; } GRUB_PACKED;

239
0003-calloc-Make-sure-we-always-have-an-overflow-checking.patch Normal file
View File

@ -0,0 +1,239 @@
From 79e51ab7a9a56f60a14f89ef047fd669977b99d1 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Mon, 15 Jun 2020 12:15:29 -0400
Subject: [PATCH 3/7] calloc: Make sure we always have an overflow-checking
calloc() available
This tries to make sure that everywhere in this source tree, we always have
an appropriate version of calloc() (i.e. grub_calloc(), xcalloc(), etc.)
available, and that they all safely check for overflow and return NULL when
it would occur.
Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
grub-core/kern/emu/misc.c | 12 +++++++++
grub-core/kern/emu/mm.c | 10 ++++++++
grub-core/kern/mm.c | 40 ++++++++++++++++++++++++++++++
grub-core/lib/libgcrypt_wrap/mem.c | 11 ++++++--
grub-core/lib/posix_wrap/stdlib.h | 8 +++++-
include/grub/emu/misc.h | 1 +
include/grub/mm.h | 6 +++++
7 files changed, 85 insertions(+), 3 deletions(-)
Index: grub-2.04/grub-core/kern/emu/misc.c
===================================================================
--- grub-2.04.orig/grub-core/kern/emu/misc.c
+++ grub-2.04/grub-core/kern/emu/misc.c
@@ -87,6 +87,18 @@ grub_util_error (const char *fmt, ...)
}
void *
+xcalloc (grub_size_t nmemb, grub_size_t size)
+{
+ void *p;
+
+ p = calloc (nmemb, size);
+ if (!p)
+ grub_util_error ("%s", _("out of memory"));
+
+ return p;
+}
+
+void *
xmalloc (grub_size_t size)
{
void *p;
Index: grub-2.04/grub-core/kern/emu/mm.c
===================================================================
--- grub-2.04.orig/grub-core/kern/emu/mm.c
+++ grub-2.04/grub-core/kern/emu/mm.c
@@ -26,6 +26,16 @@
#include <grub/i18n.h>
void *
+grub_calloc (grub_size_t nmemb, grub_size_t size)
+{
+ void *ret;
+ ret = calloc (nmemb, size);
+ if (!ret)
+ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
+ return ret;
+}
+
+void *
grub_malloc (grub_size_t size)
{
void *ret;
Index: grub-2.04/grub-core/kern/mm.c
===================================================================
--- grub-2.04.orig/grub-core/kern/mm.c
+++ grub-2.04/grub-core/kern/mm.c
@@ -67,8 +67,10 @@
#include <grub/dl.h>
#include <grub/i18n.h>
#include <grub/mm_private.h>
+#include <grub/safemath.h>
#ifdef MM_DEBUG
+# undef grub_calloc
# undef grub_malloc
# undef grub_zalloc
# undef grub_realloc
@@ -375,6 +377,30 @@ grub_memalign (grub_size_t align, grub_s
return 0;
}
+/*
+ * Allocate NMEMB instances of SIZE bytes and return the pointer, or error on
+ * integer overflow.
+ */
+void *
+grub_calloc (grub_size_t nmemb, grub_size_t size)
+{
+ void *ret;
+ grub_size_t sz = 0;
+
+ if (grub_mul (nmemb, size, &sz))
+ {
+ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+ return NULL;
+ }
+
+ ret = grub_memalign (0, sz);
+ if (!ret)
+ return NULL;
+
+ grub_memset (ret, 0, sz);
+ return ret;
+}
+
/* Allocate SIZE bytes and return the pointer. */
void *
grub_malloc (grub_size_t size)
@@ -562,6 +588,20 @@ grub_mm_dump (unsigned lineno)
}
void *
+grub_debug_calloc (const char *file, int line, grub_size_t nmemb, grub_size_t size)
+{
+ void *ptr;
+
+ if (grub_mm_debug)
+ grub_printf ("%s:%d: calloc (0x%" PRIxGRUB_SIZE ", 0x%" PRIxGRUB_SIZE ") = ",
+ file, line, size);
+ ptr = grub_calloc (nmemb, size);
+ if (grub_mm_debug)
+ grub_printf ("%p\n", ptr);
+ return ptr;
+}
+
+void *
grub_debug_malloc (const char *file, int line, grub_size_t size)
{
void *ptr;
Index: grub-2.04/grub-core/lib/libgcrypt_wrap/mem.c
===================================================================
--- grub-2.04.orig/grub-core/lib/libgcrypt_wrap/mem.c
+++ grub-2.04/grub-core/lib/libgcrypt_wrap/mem.c
@@ -4,6 +4,7 @@
#include <grub/crypto.h>
#include <grub/dl.h>
#include <grub/env.h>
+#include <grub/safemath.h>
GRUB_MOD_LICENSE ("GPLv3+");
@@ -36,7 +37,10 @@ void *
gcry_xcalloc (size_t n, size_t m)
{
void *ret;
- ret = grub_zalloc (n * m);
+ size_t sz;
+ if (grub_mul (n, m, &sz))
+ grub_fatal ("gcry_xcalloc would overflow");
+ ret = grub_zalloc (sz);
if (!ret)
grub_fatal ("gcry_xcalloc failed");
return ret;
@@ -56,7 +60,10 @@ void *
gcry_xcalloc_secure (size_t n, size_t m)
{
void *ret;
- ret = grub_zalloc (n * m);
+ size_t sz;
+ if (grub_mul (n, m, &sz))
+ grub_fatal ("gcry_xcalloc would overflow");
+ ret = grub_zalloc (sz);
if (!ret)
grub_fatal ("gcry_xcalloc failed");
return ret;
Index: grub-2.04/grub-core/lib/posix_wrap/stdlib.h
===================================================================
--- grub-2.04.orig/grub-core/lib/posix_wrap/stdlib.h
+++ grub-2.04/grub-core/lib/posix_wrap/stdlib.h
@@ -21,6 +21,7 @@
#include <grub/mm.h>
#include <grub/misc.h>
+#include <grub/safemath.h>
static inline void
free (void *ptr)
@@ -37,7 +38,12 @@ malloc (grub_size_t size)
static inline void *
calloc (grub_size_t size, grub_size_t nelem)
{
- return grub_zalloc (size * nelem);
+ grub_size_t sz;
+
+ if (grub_mul (size, nelem, &sz))
+ return NULL;
+
+ return grub_zalloc (sz);
}
static inline void *
Index: grub-2.04/include/grub/emu/misc.h
===================================================================
--- grub-2.04.orig/include/grub/emu/misc.h
+++ grub-2.04/include/grub/emu/misc.h
@@ -47,6 +47,7 @@ grub_util_device_is_mapped (const char *
#define GRUB_HOST_PRIuLONG_LONG "llu"
#define GRUB_HOST_PRIxLONG_LONG "llx"
+void * EXPORT_FUNC(xcalloc) (grub_size_t nmemb, grub_size_t size) WARN_UNUSED_RESULT;
void * EXPORT_FUNC(xmalloc) (grub_size_t size) WARN_UNUSED_RESULT;
void * EXPORT_FUNC(xrealloc) (void *ptr, grub_size_t size) WARN_UNUSED_RESULT;
char * EXPORT_FUNC(xstrdup) (const char *str) WARN_UNUSED_RESULT;
Index: grub-2.04/include/grub/mm.h
===================================================================
--- grub-2.04.orig/include/grub/mm.h
+++ grub-2.04/include/grub/mm.h
@@ -29,6 +29,7 @@
#endif
void grub_mm_init_region (void *addr, grub_size_t size);
+void *EXPORT_FUNC(grub_calloc) (grub_size_t nmemb, grub_size_t size);
void *EXPORT_FUNC(grub_malloc) (grub_size_t size);
void *EXPORT_FUNC(grub_zalloc) (grub_size_t size);
void EXPORT_FUNC(grub_free) (void *ptr);
@@ -48,6 +49,9 @@ extern int EXPORT_VAR(grub_mm_debug);
void grub_mm_dump_free (void);
void grub_mm_dump (unsigned lineno);
+#define grub_calloc(nmemb, size) \
+ grub_debug_calloc (GRUB_FILE, __LINE__, nmemb, size)
+
#define grub_malloc(size) \
grub_debug_malloc (GRUB_FILE, __LINE__, size)
@@ -63,6 +67,8 @@ void grub_mm_dump (unsigned lineno);
#define grub_free(ptr) \
grub_debug_free (GRUB_FILE, __LINE__, ptr)
+void *EXPORT_FUNC(grub_debug_calloc) (const char *file, int line,
+ grub_size_t nmemb, grub_size_t size);
void *EXPORT_FUNC(grub_debug_malloc) (const char *file, int line,
grub_size_t size);
void *EXPORT_FUNC(grub_debug_zalloc) (const char *file, int line,

1825
0004-calloc-Use-calloc-at-most-places.patch Normal file
View File

File diff suppressed because it is too large Load Diff

1319
0005-malloc-Use-overflow-checking-primitives-where-we-do-.patch Normal file
View File

File diff suppressed because it is too large Load Diff

67
0006-iso9660-Don-t-leak-memory-on-realloc-failures.patch Normal file
View File

@ -0,0 +1,67 @@
From 30508bd4692d2e022eff2e7f9c4be9f8abf57977 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Sat, 4 Jul 2020 12:25:09 -0400
Subject: [PATCH 6/7] iso9660: Don't leak memory on realloc() failures
Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
grub-core/fs/iso9660.c | 24 ++++++++++++++++++++----
1 file changed, 20 insertions(+), 4 deletions(-)
diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
index 7ba5b300b..5ec4433b8 100644
--- a/grub-core/fs/iso9660.c
+++ b/grub-core/fs/iso9660.c
@@ -533,14 +533,20 @@ add_part (struct iterate_dir_ctx *ctx,
{
int size = ctx->symlink ? grub_strlen (ctx->symlink) : 0;
grub_size_t sz;
+ char *new;
if (grub_add (size, len2, &sz) ||
grub_add (sz, 1, &sz))
return;
- ctx->symlink = grub_realloc (ctx->symlink, sz);
- if (! ctx->symlink)
- return;
+ new = grub_realloc (ctx->symlink, sz);
+ if (!new)
+ {
+ grub_free (ctx->symlink);
+ ctx->symlink = NULL;
+ return;
+ }
+ ctx->symlink = new;
grub_memcpy (ctx->symlink + size, part, len2);
ctx->symlink[size + len2] = 0;
@@ -634,7 +640,12 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,
is the length. Both are part of the `Component
Record'. */
if (ctx->symlink && !ctx->was_continue)
- add_part (ctx, "/", 1);
+ {
+ add_part (ctx, "/", 1);
+ if (grub_errno)
+ return grub_errno;
+ }
+
add_part (ctx, (char *) &entry->data[pos + 2],
entry->data[pos + 1]);
ctx->was_continue = (entry->data[pos] & 1);
@@ -653,6 +664,11 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,
add_part (ctx, "/", 1);
break;
}
+
+ /* Check if grub_realloc() failed in add_part(). */
+ if (grub_errno)
+ return grub_errno;
+
/* In pos + 1 the length of the `Component Record' is
stored. */
pos += entry->data[pos + 1] + 2;
--
2.27.0

35
0007-font-Do-not-load-more-than-one-NAME-section.patch Normal file
View File

@ -0,0 +1,35 @@
From e2b5230126b340e1d88a079cd6a5c22dd4c00682 Mon Sep 17 00:00:00 2001
From: Daniel Kiper <daniel.kiper@oracle.com>
Date: Tue, 7 Jul 2020 15:36:26 +0200
Subject: [PATCH 7/7] font: Do not load more than one NAME section
The GRUB font file can have one NAME section only. Though if somebody
crafts a broken font file with many NAME sections and loads it then the
GRUB leaks memory. So, prevent against that by loading first NAME
section and failing in controlled way on following one.
Reported-by: Chris Coulson <chris.coulson@canonical.com>
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
---
grub-core/font/font.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/grub-core/font/font.c b/grub-core/font/font.c
index 5edb477ac..d09bb38d8 100644
--- a/grub-core/font/font.c
+++ b/grub-core/font/font.c
@@ -532,6 +532,12 @@ grub_font_load (const char *filename)
if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME,
sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0)
{
+ if (font->name != NULL)
+ {
+ grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections");
+ goto fail;
+ }
+
font->name = read_section_as_string (&section);
if (!font->name)
goto fail;
--
2.27.0

33
0008-script-Remove-unused-fields-from-grub_script_functio.patch Normal file
View File

@ -0,0 +1,33 @@
From 1804acfd35cff2aab9ec9dc586f74f5e3aa83ef2 Mon Sep 17 00:00:00 2001
From: Chris Coulson <chris.coulson@canonical.com>
Date: Fri, 10 Jul 2020 11:21:14 +0100
Subject: [PATCH 18/27] script: Remove unused fields from grub_script_function
struct
Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
include/grub/script_sh.h | 5 -----
1 file changed, 5 deletions(-)
diff --git a/include/grub/script_sh.h b/include/grub/script_sh.h
index 360c2be1f..b382bcf09 100644
--- a/include/grub/script_sh.h
+++ b/include/grub/script_sh.h
@@ -359,13 +359,8 @@ struct grub_script_function
/* The script function. */
struct grub_script *func;
- /* The flags. */
- unsigned flags;
-
/* The next element. */
struct grub_script_function *next;
-
- int references;
};
typedef struct grub_script_function *grub_script_function_t;
--
2.27.0

107
0009-script-Avoid-a-use-after-free-when-redefining-a-func.patch Normal file
View File

@ -0,0 +1,107 @@
From 809f3a26897f5f648325c5741e72dc1b3db828ee Mon Sep 17 00:00:00 2001
From: Chris Coulson <chris.coulson@canonical.com>
Date: Fri, 10 Jul 2020 14:41:45 +0100
Subject: [PATCH 19/27] script: Avoid a use-after-free when redefining a
function during execution
Defining a new function with the same name as a previously defined
function causes the grub_script and associated resources for the
previous function to be freed. If the previous function is currently
executing when a function with the same name is defined, this results
in use-after-frees when processing subsequent commands in the original
function.
Instead, reject a new function definition if it has the same name as
a previously defined function, and that function is currently being
executed. Although a behavioural change, this should be backwards
compatible with existing configurations because they can't be
dependent on the current behaviour without being broken.
Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
grub-core/script/execute.c | 2 ++
grub-core/script/function.c | 16 +++++++++++++---
grub-core/script/parser.y | 3 ++-
include/grub/script_sh.h | 2 ++
4 files changed, 19 insertions(+), 4 deletions(-)
diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
index 8a9161cc8..ce83edd4b 100644
--- a/grub-core/script/execute.c
+++ b/grub-core/script/execute.c
@@ -838,7 +838,9 @@ grub_script_function_call (grub_script_function_t func, int argc, char **args)
old_scope = scope;
scope = &new_scope;
+ func->executing++;
ret = grub_script_execute (func->func);
+ func->executing--;
function_return = 0;
active_loops = loops;
diff --git a/grub-core/script/function.c b/grub-core/script/function.c
index d36655e51..3aad04bf9 100644
--- a/grub-core/script/function.c
+++ b/grub-core/script/function.c
@@ -34,6 +34,7 @@ grub_script_function_create (struct grub_script_arg *functionname_arg,
func = (grub_script_function_t) grub_malloc (sizeof (*func));
if (! func)
return 0;
+ func->executing = 0;
func->name = grub_strdup (functionname_arg->str);
if (! func->name)
@@ -60,10 +61,19 @@ grub_script_function_create (struct grub_script_arg *functionname_arg,
grub_script_function_t q;
q = *p;
- grub_script_free (q->func);
- q->func = cmd;
grub_free (func);
- func = q;
+ if (q->executing > 0)
+ {
+ grub_error (GRUB_ERR_BAD_ARGUMENT,
+ N_("attempt to redefine a function being executed"));
+ func = NULL;
+ }
+ else
+ {
+ grub_script_free (q->func);
+ q->func = cmd;
+ func = q;
+ }
}
else
{
diff --git a/grub-core/script/parser.y b/grub-core/script/parser.y
index 4f0ab8319..f80b86b6f 100644
--- a/grub-core/script/parser.y
+++ b/grub-core/script/parser.y
@@ -289,7 +289,8 @@ function: "function" "name"
grub_script_mem_free (state->func_mem);
else {
script->children = state->scripts;
- grub_script_function_create ($2, script);
+ if (!grub_script_function_create ($2, script))
+ grub_script_free (script);
}
state->scripts = $<scripts>3;
diff --git a/include/grub/script_sh.h b/include/grub/script_sh.h
index b382bcf09..6c48e0751 100644
--- a/include/grub/script_sh.h
+++ b/include/grub/script_sh.h
@@ -361,6 +361,8 @@ struct grub_script_function
/* The next element. */
struct grub_script_function *next;
+
+ unsigned executing;
};
typedef struct grub_script_function *grub_script_function_t;
--
2.27.0

164
0010-linux-Fix-integer-overflows-in-initrd-size-handling.patch Normal file
View File

@ -0,0 +1,164 @@
commit a59b854381d1148d32f74fbb9cf0f384972a5b4b
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Jul 25 12:15:37 2020 +0100
linux: Fix integer overflows in initrd size handling
These could be triggered by a crafted filesystem with very large files.
Fixes: CVE-2020-15707
Signed-off-by: Colin Watson <cjwatson@debian.org>
Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c
index 25624ebc1..e9f819ee9 100644
--- a/grub-core/loader/linux.c
+++ b/grub-core/loader/linux.c
@@ -4,6 +4,7 @@
#include <grub/misc.h>
#include <grub/file.h>
#include <grub/mm.h>
+#include <grub/safemath.h>
struct newc_head
{
@@ -98,13 +99,13 @@ free_dir (struct dir *root)
grub_free (root);
}
-static grub_size_t
+static grub_err_t
insert_dir (const char *name, struct dir **root,
- grub_uint8_t *ptr)
+ grub_uint8_t *ptr, grub_size_t *size)
{
struct dir *cur, **head = root;
const char *cb, *ce = name;
- grub_size_t size = 0;
+ *size = 0;
while (1)
{
for (cb = ce; *cb == '/'; cb++);
@@ -130,14 +131,22 @@ insert_dir (const char *name, struct dir **root,
ptr = make_header (ptr, name, ce - name,
040777, 0);
}
- size += ALIGN_UP ((ce - (char *) name)
- + sizeof (struct newc_head), 4);
+ if (grub_add (*size,
+ ALIGN_UP ((ce - (char *) name)
+ + sizeof (struct newc_head), 4),
+ size))
+ {
+ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+ grub_free (n->name);
+ grub_free (n);
+ return grub_errno;
+ }
*head = n;
cur = n;
}
root = &cur->next;
}
- return size;
+ return GRUB_ERR_NONE;
}
grub_err_t
@@ -173,26 +182,33 @@ grub_initrd_init (int argc, char *argv[],
eptr = grub_strchr (ptr, ':');
if (eptr)
{
+ grub_size_t dir_size, name_len;
+
initrd_ctx->components[i].newc_name = grub_strndup (ptr, eptr - ptr);
- if (!initrd_ctx->components[i].newc_name)
+ if (!initrd_ctx->components[i].newc_name ||
+ insert_dir (initrd_ctx->components[i].newc_name, &root, 0,
+ &dir_size))
{
grub_initrd_close (initrd_ctx);
return grub_errno;
}
- initrd_ctx->size
- += ALIGN_UP (sizeof (struct newc_head)
- + grub_strlen (initrd_ctx->components[i].newc_name),
- 4);
- initrd_ctx->size += insert_dir (initrd_ctx->components[i].newc_name,
- &root, 0);
+ name_len = grub_strlen (initrd_ctx->components[i].newc_name);
+ if (grub_add (initrd_ctx->size,
+ ALIGN_UP (sizeof (struct newc_head) + name_len, 4),
+ &initrd_ctx->size) ||
+ grub_add (initrd_ctx->size, dir_size, &initrd_ctx->size))
+ goto overflow;
newc = 1;
fname = eptr + 1;
}
}
else if (newc)
{
- initrd_ctx->size += ALIGN_UP (sizeof (struct newc_head)
- + sizeof ("TRAILER!!!") - 1, 4);
+ if (grub_add (initrd_ctx->size,
+ ALIGN_UP (sizeof (struct newc_head)
+ + sizeof ("TRAILER!!!") - 1, 4),
+ &initrd_ctx->size))
+ goto overflow;
free_dir (root);
root = 0;
newc = 0;
@@ -208,19 +224,29 @@ grub_initrd_init (int argc, char *argv[],
initrd_ctx->nfiles++;
initrd_ctx->components[i].size
= grub_file_size (initrd_ctx->components[i].file);
- initrd_ctx->size += initrd_ctx->components[i].size;
+ if (grub_add (initrd_ctx->size, initrd_ctx->components[i].size,
+ &initrd_ctx->size))
+ goto overflow;
}
if (newc)
{
initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4);
- initrd_ctx->size += ALIGN_UP (sizeof (struct newc_head)
- + sizeof ("TRAILER!!!") - 1, 4);
+ if (grub_add (initrd_ctx->size,
+ ALIGN_UP (sizeof (struct newc_head)
+ + sizeof ("TRAILER!!!") - 1, 4),
+ &initrd_ctx->size))
+ goto overflow;
free_dir (root);
root = 0;
}
return GRUB_ERR_NONE;
+
+overflow:
+ free_dir (root);
+ grub_initrd_close (initrd_ctx);
+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
}
grub_size_t
@@ -261,8 +287,16 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx,
if (initrd_ctx->components[i].newc_name)
{
- ptr += insert_dir (initrd_ctx->components[i].newc_name,
- &root, ptr);
+ grub_size_t dir_size;
+
+ if (insert_dir (initrd_ctx->components[i].newc_name, &root, ptr,
+ &dir_size))
+ {
+ free_dir (root);
+ grub_initrd_close (initrd_ctx);
+ return grub_errno;
+ }
+ ptr += dir_size;
ptr = make_header (ptr, initrd_ctx->components[i].newc_name,
grub_strlen (initrd_ctx->components[i].newc_name),
0100777,

52
grub2-btrfs-01-add-ability-to-boot-from-subvolumes.patch
View File

@ -16,15 +16,20 @@ It is possible to boot into a separate GRUB instance by exporting the
variable and loading the config file from the subvolume. variable and loading the config file from the subvolume.
Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Jeff Mahoney <jeffm@suse.com>
V1:
* Use overflow checking primitives where the arithmetic expression for
buffer allocations may include unvalidated data
--- ---
grub-core/fs/btrfs.c | 529 +++++++++++++++++++++++++++++++++++++++++++++++++-- grub-core/fs/btrfs.c | 529 +++++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 518 insertions(+), 11 deletions(-) 1 file changed, 518 insertions(+), 11 deletions(-)
Index: grub-2.04~rc1/grub-core/fs/btrfs.c Index: grub-2.04/grub-core/fs/btrfs.c
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/fs/btrfs.c --- grub-2.04.orig/grub-core/fs/btrfs.c
+++ grub-2.04~rc1/grub-core/fs/btrfs.c +++ grub-2.04/grub-core/fs/btrfs.c
@@ -40,6 +40,9 @@ @@ -40,6 +40,9 @@
#include <grub/btrfs.h> #include <grub/btrfs.h>
#include <grub/crypto.h> #include <grub/crypto.h>
@ -164,7 +169,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
return data; return data;
} }
@@ -1654,6 +1739,91 @@ get_root (struct grub_btrfs_data *data, @@ -1654,6 +1739,98 @@ get_root (struct grub_btrfs_data *data,
} }
static grub_err_t static grub_err_t
@ -207,8 +212,12 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
+ key_out.object_id != key_out.offset) { + key_out.object_id != key_out.offset) {
+ struct grub_btrfs_inode_ref *inode_ref; + struct grub_btrfs_inode_ref *inode_ref;
+ char *new; + char *new;
+ grub_size_t sz;
+ +
+ inode_ref = grub_malloc(elemsize + 1); + if (grub_add (elemsize, 1, &sz))
+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+
+ inode_ref = grub_malloc(sz);
+ if (!inode_ref) + if (!inode_ref)
+ return grub_error(GRUB_ERR_OUT_OF_MEMORY, + return grub_error(GRUB_ERR_OUT_OF_MEMORY,
+ "couldn't allocate memory for inode_ref (%"PRIuGRUB_SIZE")\n", elemsize); + "couldn't allocate memory for inode_ref (%"PRIuGRUB_SIZE")\n", elemsize);
@ -217,7 +226,10 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
+ if (err) + if (err)
+ return grub_error(err, "read_logical caught %d\n", err); + return grub_error(err, "read_logical caught %d\n", err);
+ +
+ alloc += grub_le_to_cpu16 (inode_ref->n) + 2; + if (grub_add (grub_le_to_cpu16 (inode_ref->n), 2, &sz) ||
+ grub_add (alloc, sz, &alloc))
+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+
+ new = grub_malloc(alloc); + new = grub_malloc(alloc);
+ if (!new) + if (!new)
+ return grub_error(GRUB_ERR_OUT_OF_MEMORY, + return grub_error(GRUB_ERR_OUT_OF_MEMORY,
@ -256,7 +268,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
find_path (struct grub_btrfs_data *data, find_path (struct grub_btrfs_data *data,
const char *path, struct grub_btrfs_key *key, const char *path, struct grub_btrfs_key *key,
grub_uint64_t *tree, grub_uint8_t *type) grub_uint64_t *tree, grub_uint8_t *type)
@@ -1671,14 +1841,26 @@ find_path (struct grub_btrfs_data *data, @@ -1671,14 +1848,26 @@ find_path (struct grub_btrfs_data *data,
char *origpath = NULL; char *origpath = NULL;
unsigned symlinks_max = 32; unsigned symlinks_max = 32;
@ -287,7 +299,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
while (1) while (1)
{ {
while (path[0] == '/') while (path[0] == '/')
@@ -1851,9 +2033,21 @@ find_path (struct grub_btrfs_data *data, @@ -1851,9 +2040,21 @@ find_path (struct grub_btrfs_data *data,
path = path_alloc = tmp; path = path_alloc = tmp;
if (path[0] == '/') if (path[0] == '/')
{ {
@ -312,7 +324,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
} }
continue; continue;
} }
@@ -2094,6 +2288,20 @@ grub_btrfs_read (grub_file_t file, char @@ -2094,6 +2295,20 @@ grub_btrfs_read (grub_file_t file, char
data->tree, file->offset, buf, len); data->tree, file->offset, buf, len);
} }
@ -333,7 +345,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
static grub_err_t static grub_err_t
grub_btrfs_uuid (grub_device_t device, char **uuid) grub_btrfs_uuid (grub_device_t device, char **uuid)
{ {
@@ -2105,15 +2313,7 @@ grub_btrfs_uuid (grub_device_t device, c @@ -2105,15 +2320,7 @@ grub_btrfs_uuid (grub_device_t device, c
if (!data) if (!data)
return grub_errno; return grub_errno;
@ -350,7 +362,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
grub_btrfs_unmount (data); grub_btrfs_unmount (data);
@@ -2170,6 +2370,242 @@ grub_btrfs_embed (grub_device_t device _ @@ -2170,6 +2377,248 @@ grub_btrfs_embed (grub_device_t device _
} }
#endif #endif
@ -531,9 +543,15 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
+ +
+ if (elemsize > allocated) + if (elemsize > allocated)
+ { + {
+ grub_size_t sz;
+
+ grub_free(buf); + grub_free(buf);
+ allocated = 2 * elemsize; +
+ buf = grub_malloc(allocated + 1); + if (grub_mul (elemsize, 2, &allocated) ||
+ grub_add (allocated, 1, &sz))
+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+
+ buf = grub_malloc(sz);
+ if (!buf) + if (!buf)
+ { + {
+ r = -grub_errno; + r = -grub_errno;
@ -593,7 +611,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
static struct grub_fs grub_btrfs_fs = { static struct grub_fs grub_btrfs_fs = {
.name = "btrfs", .name = "btrfs",
.fs_dir = grub_btrfs_dir, .fs_dir = grub_btrfs_dir,
@@ -2185,12 +2621,88 @@ static struct grub_fs grub_btrfs_fs = { @@ -2185,12 +2634,88 @@ static struct grub_fs grub_btrfs_fs = {
#endif #endif
}; };
@ -682,10 +700,10 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
} }
+ +
+// vim: si et sw=2: +// vim: si et sw=2:
Index: grub-2.04~rc1/include/grub/btrfs.h Index: grub-2.04/include/grub/btrfs.h
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/include/grub/btrfs.h --- grub-2.04.orig/include/grub/btrfs.h
+++ grub-2.04~rc1/include/grub/btrfs.h +++ grub-2.04/include/grub/btrfs.h
@@ -29,6 +29,7 @@ enum @@ -29,6 +29,7 @@ enum
GRUB_BTRFS_ITEM_TYPE_ROOT_ITEM = 0x84, GRUB_BTRFS_ITEM_TYPE_ROOT_ITEM = 0x84,
GRUB_BTRFS_ITEM_TYPE_ROOT_BACKREF = 0x90, GRUB_BTRFS_ITEM_TYPE_ROOT_BACKREF = 0x90,

33
grub2-btrfs-09-get-default-subvolume.patch
View File

@ -1,8 +1,13 @@
Index: grub-2.04~rc1/grub-core/fs/btrfs.c
V1:
* Use overflow checking primitives where the arithmetic expression for
buffer allocations may include unvalidated data
Index: grub-2.04/grub-core/fs/btrfs.c
=================================================================== ===================================================================
--- grub-2.04~rc1.orig/grub-core/fs/btrfs.c --- grub-2.04.orig/grub-core/fs/btrfs.c
+++ grub-2.04~rc1/grub-core/fs/btrfs.c +++ grub-2.04/grub-core/fs/btrfs.c
@@ -2867,6 +2867,242 @@ out: @@ -2880,6 +2880,254 @@ out:
return 0; return 0;
} }
@ -26,6 +31,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
+ grub_disk_addr_t elemaddr; + grub_disk_addr_t elemaddr;
+ grub_err_t err; + grub_err_t err;
+ char *parent_path; + char *parent_path;
+ grub_size_t sz;
+ +
+ *parent_id = 0; + *parent_id = 0;
+ *path_out = 0; + *path_out = 0;
@ -44,7 +50,10 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
+ return grub_error(GRUB_ERR_FILE_NOT_FOUND, N_("can't find root backrefs")); + return grub_error(GRUB_ERR_FILE_NOT_FOUND, N_("can't find root backrefs"));
+ } + }
+ +
+ buf = grub_malloc(elemsize + 1); + if (grub_add (elemsize, 1, &sz))
+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+
+ buf = grub_malloc(sz);
+ if (!buf) + if (!buf)
+ { + {
+ free_iterator(&desc); + free_iterator(&desc);
@ -98,6 +107,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
+ struct grub_btrfs_dir_item *direl = NULL; + struct grub_btrfs_dir_item *direl = NULL;
+ const char *ctoken = "default"; + const char *ctoken = "default";
+ grub_size_t ctokenlen = sizeof ("default") - 1; + grub_size_t ctokenlen = sizeof ("default") - 1;
+ grub_size_t sz;
+ +
+ *id = 0; + *id = 0;
+ key.object_id = data->sblock.root_dir_objectid; + key.object_id = data->sblock.root_dir_objectid;
@ -112,7 +122,14 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
+ return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("file not found")); + return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("file not found"));
+ +
+ struct grub_btrfs_dir_item *cdirel; + struct grub_btrfs_dir_item *cdirel;
+ direl = grub_malloc (elemsize + 1); +
+ if (grub_add (elemsize, 1, &sz))
+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+
+ direl = grub_malloc (sz);
+ if (!direl)
+ return grub_errno;
+
+ err = grub_btrfs_read_logical (data, elemaddr, direl, elemsize, 0); + err = grub_btrfs_read_logical (data, elemaddr, direl, elemsize, 0);
+ if (err) + if (err)
+ { + {
@ -245,7 +262,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
static struct grub_fs grub_btrfs_fs = { static struct grub_fs grub_btrfs_fs = {
.name = "btrfs", .name = "btrfs",
.fs_dir = grub_btrfs_dir, .fs_dir = grub_btrfs_dir,
@@ -2885,6 +3121,7 @@ static struct grub_fs grub_btrfs_fs = { @@ -2898,6 +3146,7 @@ static struct grub_fs grub_btrfs_fs = {
static grub_command_t cmd_info; static grub_command_t cmd_info;
static grub_command_t cmd_mount_subvol; static grub_command_t cmd_mount_subvol;
static grub_extcmd_t cmd_list_subvols; static grub_extcmd_t cmd_list_subvols;
@ -253,7 +270,7 @@ Index: grub-2.04~rc1/grub-core/fs/btrfs.c
static char * static char *
subvolid_set_env (struct grub_env_var *var __attribute__ ((unused)), subvolid_set_env (struct grub_env_var *var __attribute__ ((unused)),
@@ -2955,6 +3192,11 @@ GRUB_MOD_INIT (btrfs) @@ -2968,6 +3217,11 @@ GRUB_MOD_INIT (btrfs)
"[-p|-n] [-o var] DEVICE", "[-p|-n] [-o var] DEVICE",
"Print list of BtrFS subvolumes on " "Print list of BtrFS subvolumes on "
"DEVICE.", options); "DEVICE.", options);

94
grub2-gfxmenu-support-scrolling-menu-entry-s-text.patch
View File

@ -14,6 +14,10 @@ gfxmenu to make it convenient for viewing the truncated text by pressing
the ctrl+l and ctrl+r to scroll the highlighted text left and right. The the ctrl+l and ctrl+r to scroll the highlighted text left and right. The
scrolled result will remain in place to help memorizing it after scrolled result will remain in place to help memorizing it after
changing highlight to other entry. changing highlight to other entry.
V1:
* Use grub_calloc for overflow check and return NULL when it would
occur.
--- ---
grub-core/gfxmenu/gfxmenu.c | 3 +++ grub-core/gfxmenu/gfxmenu.c | 3 +++
grub-core/gfxmenu/gui_label.c | 2 ++ grub-core/gfxmenu/gui_label.c | 2 ++
@ -24,20 +28,27 @@ changing highlight to other entry.
include/grub/menu_viewer.h | 1 + include/grub/menu_viewer.h | 1 +
7 files changed, 112 insertions(+) 7 files changed, 112 insertions(+)
diff --git a/grub-core/gfxmenu/gfxmenu.c b/grub-core/gfxmenu/gfxmenu.c Index: grub-2.04/grub-core/gfxmenu/gfxmenu.c
index 8a17dda2c..e834895fb 100644 ===================================================================
--- a/grub-core/gfxmenu/gfxmenu.c --- grub-2.04.orig/grub-core/gfxmenu/gfxmenu.c
+++ b/grub-core/gfxmenu/gfxmenu.c +++ grub-2.04/grub-core/gfxmenu/gfxmenu.c
@@ -108,6 +108,8 @@ grub_gfxmenu_try (int entry, grub_menu_t menu, int nested) @@ -108,6 +108,15 @@ grub_gfxmenu_try (int entry, grub_menu_t
view->menu = menu; view->menu = menu;
view->nested = nested; view->nested = nested;
view->first_timeout = -1; view->first_timeout = -1;
+ if (menu->size) + if (menu->size)
+ view->menu_title_offset = grub_zalloc (sizeof (*view->menu_title_offset) * menu->size); + {
+ view->menu_title_offset = grub_calloc (menu->size, sizeof (*view->menu_title_offset));
+ if (!view->menu_title_offset)
+ {
+ grub_free (instance);
+ return grub_errno;
+ }
+ }
grub_video_set_viewport (0, 0, mode_info.width, mode_info.height); grub_video_set_viewport (0, 0, mode_info.width, mode_info.height);
if (view->double_repaint) if (view->double_repaint)
@@ -123,6 +125,7 @@ grub_gfxmenu_try (int entry, grub_menu_t menu, int nested) @@ -123,6 +132,7 @@ grub_gfxmenu_try (int entry, grub_menu_t
instance->fini = grub_gfxmenu_viewer_fini; instance->fini = grub_gfxmenu_viewer_fini;
instance->print_timeout = grub_gfxmenu_print_timeout; instance->print_timeout = grub_gfxmenu_print_timeout;
instance->clear_timeout = grub_gfxmenu_clear_timeout; instance->clear_timeout = grub_gfxmenu_clear_timeout;
@ -45,11 +56,11 @@ index 8a17dda2c..e834895fb 100644
grub_menu_register_viewer (instance); grub_menu_register_viewer (instance);
diff --git a/grub-core/gfxmenu/gui_label.c b/grub-core/gfxmenu/gui_label.c Index: grub-2.04/grub-core/gfxmenu/gui_label.c
index a4c817891..8b1358dd4 100644 ===================================================================
--- a/grub-core/gfxmenu/gui_label.c --- grub-2.04.orig/grub-core/gfxmenu/gui_label.c
+++ b/grub-core/gfxmenu/gui_label.c +++ grub-2.04/grub-core/gfxmenu/gui_label.c
@@ -192,6 +192,8 @@ label_set_property (void *vself, const char *name, const char *value) @@ -192,6 +192,8 @@ label_set_property (void *vself, const c
"or `c' for a command-line."); "or `c' for a command-line.");
else if (grub_strcmp (value, "@KEYMAP_SHORT@") == 0) else if (grub_strcmp (value, "@KEYMAP_SHORT@") == 0)
value = _("enter: boot, `e': options, `c': cmd-line"); value = _("enter: boot, `e': options, `c': cmd-line");
@ -58,10 +69,10 @@ index a4c817891..8b1358dd4 100644
/* FIXME: Add more templates here if needed. */ /* FIXME: Add more templates here if needed. */
self->template = grub_strdup (value); self->template = grub_strdup (value);
self->text = grub_xasprintf (value, self->value); self->text = grub_xasprintf (value, self->value);
diff --git a/grub-core/gfxmenu/gui_list.c b/grub-core/gfxmenu/gui_list.c Index: grub-2.04/grub-core/gfxmenu/gui_list.c
index 01477cdf2..90487aef4 100644 ===================================================================
--- a/grub-core/gfxmenu/gui_list.c --- grub-2.04.orig/grub-core/gfxmenu/gui_list.c
+++ b/grub-core/gfxmenu/gui_list.c +++ grub-2.04/grub-core/gfxmenu/gui_list.c
@@ -24,6 +24,7 @@ @@ -24,6 +24,7 @@
#include <grub/gfxmenu_view.h> #include <grub/gfxmenu_view.h>
#include <grub/gfxwidgets.h> #include <grub/gfxwidgets.h>
@ -104,7 +115,7 @@ index 01477cdf2..90487aef4 100644
/* Draw the list of items. */ /* Draw the list of items. */
static void static void
draw_menu (list_impl_t self, int num_shown_items) draw_menu (list_impl_t self, int num_shown_items)
@@ -433,6 +461,16 @@ draw_menu (list_impl_t self, int num_shown_items) @@ -433,6 +461,16 @@ draw_menu (list_impl_t self, int num_sho
const char *item_title = const char *item_title =
grub_menu_get_entry (self->view->menu, menu_index)->title; grub_menu_get_entry (self->view->menu, menu_index)->title;
@ -121,10 +132,10 @@ index 01477cdf2..90487aef4 100644
sviewport.y = item_top + top_pad; sviewport.y = item_top + top_pad;
sviewport.width = viewport_width; sviewport.width = viewport_width;
grub_gui_set_viewport (&sviewport, &svpsave); grub_gui_set_viewport (&sviewport, &svpsave);
diff --git a/grub-core/gfxmenu/view.c b/grub-core/gfxmenu/view.c Index: grub-2.04/grub-core/gfxmenu/view.c
index ad5e82b81..7aed7faa1 100644 ===================================================================
--- a/grub-core/gfxmenu/view.c --- grub-2.04.orig/grub-core/gfxmenu/view.c
+++ b/grub-core/gfxmenu/view.c +++ grub-2.04/grub-core/gfxmenu/view.c
@@ -37,6 +37,7 @@ @@ -37,6 +37,7 @@
#include <grub/gui_string_util.h> #include <grub/gui_string_util.h>
#include <grub/icon_manager.h> #include <grub/icon_manager.h>
@ -133,7 +144,7 @@ index ad5e82b81..7aed7faa1 100644
static void static void
init_terminal (grub_gfxmenu_view_t view); init_terminal (grub_gfxmenu_view_t view);
@@ -142,6 +143,7 @@ grub_gfxmenu_view_destroy (grub_gfxmenu_view_t view) @@ -142,6 +143,7 @@ grub_gfxmenu_view_destroy (grub_gfxmenu_
grub_free (view->title_text); grub_free (view->title_text);
grub_free (view->progress_message_text); grub_free (view->progress_message_text);
grub_free (view->theme_path); grub_free (view->theme_path);
@ -141,7 +152,7 @@ index ad5e82b81..7aed7faa1 100644
if (view->canvas) if (view->canvas)
view->canvas->component.ops->destroy (view->canvas); view->canvas->component.ops->destroy (view->canvas);
grub_free (view); grub_free (view);
@@ -410,6 +412,52 @@ grub_gfxmenu_set_chosen_entry (int entry, void *data) @@ -410,6 +412,52 @@ grub_gfxmenu_set_chosen_entry (int entry
grub_gfxmenu_redraw_menu (view); grub_gfxmenu_redraw_menu (view);
} }
@ -194,15 +205,14 @@ index ad5e82b81..7aed7faa1 100644
static void static void
grub_gfxmenu_draw_terminal_box (void) grub_gfxmenu_draw_terminal_box (void)
{ {
diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c Index: grub-2.04/grub-core/normal/menu.c
index e7a83c2d6..0af20d052 100644 ===================================================================
--- a/grub-core/normal/menu.c --- grub-2.04.orig/grub-core/normal/menu.c
+++ b/grub-core/normal/menu.c +++ grub-2.04/grub-core/normal/menu.c
@@ -376,6 +376,15 @@ menu_set_chosen_entry (int entry) @@ -401,6 +401,15 @@ menu_set_chosen_entry (int entry)
cur->set_chosen_entry (entry, cur->data);
} }
+static void static void
+menu_scroll_chosen_entry (int diren) +menu_scroll_chosen_entry (int diren)
+{ +{
+ struct grub_menu_viewer *cur; + struct grub_menu_viewer *cur;
@ -211,10 +221,11 @@ index e7a83c2d6..0af20d052 100644
+ cur->scroll_chosen_entry (cur->data, diren); + cur->scroll_chosen_entry (cur->data, diren);
+} +}
+ +
static void +static void
menu_print_timeout (int timeout) menu_print_timeout (int timeout)
{ {
@@ -755,6 +764,13 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot) struct grub_menu_viewer *cur;
@@ -828,6 +837,13 @@ run_menu (grub_menu_t menu, int nested,
menu_set_chosen_entry (current_entry); menu_set_chosen_entry (current_entry);
break; break;
@ -228,10 +239,10 @@ index e7a83c2d6..0af20d052 100644
case '\n': case '\n':
case '\r': case '\r':
case GRUB_TERM_KEY_RIGHT: case GRUB_TERM_KEY_RIGHT:
diff --git a/include/grub/gfxmenu_view.h b/include/grub/gfxmenu_view.h Index: grub-2.04/include/grub/gfxmenu_view.h
index 4203c8fb9..56c0d17ae 100644 ===================================================================
--- a/include/grub/gfxmenu_view.h --- grub-2.04.orig/include/grub/gfxmenu_view.h
+++ b/include/grub/gfxmenu_view.h +++ grub-2.04/include/grub/gfxmenu_view.h
@@ -61,6 +61,8 @@ void @@ -61,6 +61,8 @@ void
grub_gfxmenu_print_timeout (int timeout, void *data); grub_gfxmenu_print_timeout (int timeout, void *data);
void void
@ -250,10 +261,10 @@ index 4203c8fb9..56c0d17ae 100644
}; };
#endif /* ! GRUB_GFXMENU_VIEW_HEADER */ #endif /* ! GRUB_GFXMENU_VIEW_HEADER */
diff --git a/include/grub/menu_viewer.h b/include/grub/menu_viewer.h Index: grub-2.04/include/grub/menu_viewer.h
index c6513c4e8..5f2a39dc9 100644 ===================================================================
--- a/include/grub/menu_viewer.h --- grub-2.04.orig/include/grub/menu_viewer.h
+++ b/include/grub/menu_viewer.h +++ grub-2.04/include/grub/menu_viewer.h
@@ -33,6 +33,7 @@ struct grub_menu_viewer @@ -33,6 +33,7 @@ struct grub_menu_viewer
void (*set_chosen_entry) (int entry, void *data); void (*set_chosen_entry) (int entry, void *data);
void (*print_timeout) (int timeout, void *data); void (*print_timeout) (int timeout, void *data);
@ -262,6 +273,3 @@ index c6513c4e8..5f2a39dc9 100644
void (*fini) (void *fini); void (*fini) (void *fini);
}; };
--
2.16.4

33
grub2-grubenv-in-btrfs-header.patch
View File

@ -4,11 +4,16 @@ As a workaround use the Btrfs header to store known data of the GRUB environment
block. block.
v2: export env_block and make sure to use the device of grubenv v2: export env_block and make sure to use the device of grubenv
v3:
* Use xcalloc for overflow check and return NULL when it would
occur.
--- ---
Index: grub-2.02/grub-core/kern/fs.c Index: grub-2.04/grub-core/kern/fs.c
=================================================================== ===================================================================
--- grub-2.02.orig/grub-core/kern/fs.c --- grub-2.04.orig/grub-core/kern/fs.c
+++ grub-2.02/grub-core/kern/fs.c +++ grub-2.04/grub-core/kern/fs.c
@@ -27,6 +27,7 @@ @@ -27,6 +27,7 @@
#include <grub/mm.h> #include <grub/mm.h>
#include <grub/term.h> #include <grub/term.h>
@ -31,10 +36,10 @@ Index: grub-2.02/grub-core/kern/fs.c
ret += size; ret += size;
len -= size; len -= size;
sector -= ((size + offset) >> GRUB_DISK_SECTOR_BITS); sector -= ((size + offset) >> GRUB_DISK_SECTOR_BITS);
Index: grub-2.02/util/grub-editenv.c Index: grub-2.04/util/grub-editenv.c
=================================================================== ===================================================================
--- grub-2.02.orig/util/grub-editenv.c --- grub-2.04.orig/util/grub-editenv.c
+++ grub-2.02/util/grub-editenv.c +++ grub-2.04/util/grub-editenv.c
@@ -23,8 +23,11 @@ @@ -23,8 +23,11 @@
#include <grub/util/misc.h> #include <grub/util/misc.h>
#include <grub/lib/envblk.h> #include <grub/lib/envblk.h>
@ -207,7 +212,7 @@ Index: grub-2.02/util/grub-editenv.c
} }
static void static void
@@ -202,6 +346,38 @@ write_envblk (const char *name, grub_env @@ -203,6 +347,38 @@ write_envblk (const char *name, grub_env
} }
static void static void
@ -246,7 +251,7 @@ Index: grub-2.02/util/grub-editenv.c
set_variables (const char *name, int argc, char *argv[]) set_variables (const char *name, int argc, char *argv[])
{ {
grub_envblk_t envblk; grub_envblk_t envblk;
@@ -217,8 +393,27 @@ set_variables (const char *name, int arg @@ -218,8 +394,27 @@ set_variables (const char *name, int arg
*(p++) = 0; *(p++) = 0;
@ -276,7 +281,7 @@ Index: grub-2.02/util/grub-editenv.c
argc--; argc--;
argv++; argv++;
@@ -226,26 +421,158 @@ set_variables (const char *name, int arg @@ -227,26 +422,158 @@ set_variables (const char *name, int arg
write_envblk (name, envblk); write_envblk (name, envblk);
grub_envblk_close (envblk); grub_envblk_close (envblk);
@ -371,7 +376,7 @@ Index: grub-2.02/util/grub-editenv.c
+ ndev++; + ndev++;
+ } + }
+ +
+ grub_drives = xmalloc (sizeof (grub_drives[0]) * (ndev + 1)); + grub_drives = xcalloc ((ndev + 1), sizeof (grub_drives[0]));
+ +
+ for (curdev = grub_devices, curdrive = grub_drives; *curdev; curdev++, + for (curdev = grub_devices, curdrive = grub_drives; *curdev; curdev++,
+ curdrive++) + curdrive++)
@ -435,7 +440,7 @@ Index: grub-2.02/util/grub-editenv.c
int int
main (int argc, char *argv[]) main (int argc, char *argv[])
{ {
@@ -277,6 +604,9 @@ main (int argc, char *argv[]) @@ -278,6 +605,9 @@ main (int argc, char *argv[])
command = argv[curindex++]; command = argv[curindex++];
} }
@ -445,10 +450,10 @@ Index: grub-2.02/util/grub-editenv.c
if (strcmp (command, "create") == 0) if (strcmp (command, "create") == 0)
grub_util_create_envblk_file (filename); grub_util_create_envblk_file (filename);
else if (strcmp (command, "list") == 0) else if (strcmp (command, "list") == 0)
Index: grub-2.02/util/grub.d/00_header.in Index: grub-2.04/util/grub.d/00_header.in
=================================================================== ===================================================================
--- grub-2.02.orig/util/grub.d/00_header.in --- grub-2.04.orig/util/grub.d/00_header.in
+++ grub-2.02/util/grub.d/00_header.in +++ grub-2.04/util/grub.d/00_header.in
@@ -46,6 +46,13 @@ cat << EOF @@ -46,6 +46,13 @@ cat << EOF
if [ -s \$prefix/grubenv ]; then if [ -s \$prefix/grubenv ]; then
load_env load_env

28
grub2.changes
View File

@ -1,3 +1,31 @@
-------------------------------------------------------------------
Mon Jul 27 10:04:49 UTC 2020 - Michael Chang <mchang@suse.com>
- Fix for CVE-2020-10713 (bsc#1168994)
* 0001-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch
- Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311
(bsc#1173812)
* 0002-safemath-Add-some-arithmetic-primitives-that-check-f.patch
* 0003-calloc-Make-sure-we-always-have-an-overflow-checking.patch
* 0004-calloc-Use-calloc-at-most-places.patch
* 0005-malloc-Use-overflow-checking-primitives-where-we-do-.patch
* 0006-iso9660-Don-t-leak-memory-on-realloc-failures.patch
* 0007-font-Do-not-load-more-than-one-NAME-section.patch
- Fix CVE-2020-15706 (bsc#1174463)
* 0008-script-Remove-unused-fields-from-grub_script_functio.patch
* 0009-script-Avoid-a-use-after-free-when-redefining-a-func.patch
- Fix CVE-2020-15707 (bsc#1174570)
* 0010-linux-Fix-integer-overflows-in-initrd-size-handling.patch
- Use overflow checking primitives where the arithmetic expression for buffer
allocations may include unvalidated data
- Use grub_calloc for overflow check and return NULL when it would occur
* 0001-add-support-for-UEFI-network-protocols.patch
* 0003-bootp-New-net_bootp6-command.patch
* grub2-btrfs-01-add-ability-to-boot-from-subvolumes.patch
* grub2-btrfs-09-get-default-subvolume.patch
* grub2-gfxmenu-support-scrolling-menu-entry-s-text.patch
* grub2-grubenv-in-btrfs-header.patch
------------------------------------------------------------------- -------------------------------------------------------------------
Thu Jul 16 13:15:27 UTC 2020 - Michel Normand <normand@linux.vnet.ibm.com> Thu Jul 16 13:15:27 UTC 2020 - Michel Normand <normand@linux.vnet.ibm.com>

28
grub2.spec
View File

@ -302,6 +302,24 @@ Patch700: 0001-normal-Move-common-datetime-functions-out-of-the-nor.patch
Patch701: 0002-kern-Add-X-option-to-printf-functions.patch Patch701: 0002-kern-Add-X-option-to-printf-functions.patch
Patch702: 0003-normal-main-Search-for-specific-config-files-for-net.patch Patch702: 0003-normal-main-Search-for-specific-config-files-for-net.patch
Patch703: 0004-datetime-Enable-the-datetime-module-for-the-emu-plat.patch Patch703: 0004-datetime-Enable-the-datetime-module-for-the-emu-plat.patch
# bsc#1168994 VUL-0: EMBARGOED: CVE-2020-10713: grub2: parsing overflows can
# bypass secure boot restrictions
Patch704: 0001-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch
# bsc#1173812 VUL-0: EMBARGOED: CVE-2020-14308, CVE-2020-14309, CVE-2020-14310,
# CVE-2020-14311: grub2: avoid integer overflows
Patch705: 0002-safemath-Add-some-arithmetic-primitives-that-check-f.patch
Patch706: 0003-calloc-Make-sure-we-always-have-an-overflow-checking.patch
Patch707: 0004-calloc-Use-calloc-at-most-places.patch
Patch708: 0005-malloc-Use-overflow-checking-primitives-where-we-do-.patch
Patch709: 0006-iso9660-Don-t-leak-memory-on-realloc-failures.patch
Patch710: 0007-font-Do-not-load-more-than-one-NAME-section.patch
# bsc#1174463 VUL-0: EMBARGOED: CVE-2020-15706: grub2: script: Avoid a
# use-after-free when redefining a function during execution
Patch711: 0008-script-Remove-unused-fields-from-grub_script_functio.patch
Patch712: 0009-script-Avoid-a-use-after-free-when-redefining-a-func.patch
# bsc#1174570 VUL-0: EMBARGOED: CVE-2020-15707: grub2: linux: Fix integer
# overflows in initrd size handling
Patch713: 0010-linux-Fix-integer-overflows-in-initrd-size-handling.patch
Requires: gettext-runtime Requires: gettext-runtime
%if 0%{?suse_version} >= 1140 %if 0%{?suse_version} >= 1140
@ -607,6 +625,16 @@ swap partition while in resuming
%patch701 -p1 %patch701 -p1
%patch702 -p1 %patch702 -p1
%patch703 -p1 %patch703 -p1
%patch704 -p1
%patch705 -p1
%patch706 -p1
%patch707 -p1
%patch708 -p1
%patch709 -p1
%patch710 -p1
%patch711 -p1
%patch712 -p1
%patch713 -p1
%build %build
# collect evidence to debug spurious build failure on SLE15 # collect evidence to debug spurious build failure on SLE15