From 9126fb474968a1f4ea8e233c5746fa735a07b3d4 Mon Sep 17 00:00:00 2001 From: Lidong Chen Date: Fri, 22 Nov 2024 06:27:56 +0000 Subject: [PATCH 14/20] gettext: Integer overflow leads to heap OOB write or read Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may overflow leading to subsequent OOB write or read. This patch fixes the issue by replacing grub_zalloc() and explicit multiplication with grub_calloc() which does the same thing in safe manner. Fixes: CVE-2024-45776 Reported-by: Nils Langius Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper Reviewed-by: Alec Brown --- grub-core/gettext/gettext.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c index e4f4f8ee66..63bb1ab73f 100644 --- a/grub-core/gettext/gettext.c +++ b/grub-core/gettext/gettext.c @@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx, for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log; ctx->grub_gettext_max_log++); - ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max - * sizeof (ctx->grub_gettext_msg_list[0])); + ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max, + sizeof (ctx->grub_gettext_msg_list[0])); if (!ctx->grub_gettext_msg_list) { grub_file_close (fd); -- 2.48.1