8e2eae8e3f
- Security fixes for 2024 * 0001-misc-Implement-grub_strlcpy.patch - Fix CVE-2024-45781 (bsc#1233617) * 0002-fs-ufs-Fix-a-heap-OOB-write.patch - Fix CVE-2024-56737 (bsc#1234958) - Fix CVE-2024-45782 (bsc#1233615) * 0003-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch - Fix CVE-2024-45780 (bsc#1233614) * 0004-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch - Fix CVE-2024-45783 (bsc#1233616) * 0005-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch * 0006-kern-file-Ensure-file-data-is-set.patch * 0007-kern-file-Implement-filesystem-reference-counting.patch - Fix CVE-2025-0624 (bsc#1236316) * 0008-net-Fix-OOB-write-in-grub_net_search_config_file.patch - Fix CVE-2024-45774 (bsc#1233609) * 0009-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch - Fix CVE-2024-45775 (bsc#1233610) * 0010-commands-extcmd-Missing-check-for-failed-allocation.patch - Fix CVE-2025-0622 (bsc#1236317) * 0011-commands-pgp-Unregister-the-check_signatures-hooks-o.patch - Fix CVE-2025-0622 (bsc#1236317) * 0012-normal-Remove-variables-hooks-on-module-unload.patch - Fix CVE-2025-0622 (bsc#1236317) * 0013-gettext-Remove-variables-hooks-on-module-unload.patch - Fix CVE-2024-45776 (bsc#1233612) * 0014-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch - Fix CVE-2024-45777 (bsc#1233613) * 0015-gettext-Integer-overflow-leads-to-heap-OOB-write.patch - Fix CVE-2025-0690 (bsc#1237012) OBS-URL: https://build.opensuse.org/request/show/1246819 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=528
69 lines
1.9 KiB
Diff
69 lines
1.9 KiB
Diff
From f0a61161f74f9855af84778261338224d926a61f Mon Sep 17 00:00:00 2001
|
|
From: B Horn <b@horn.uk>
|
|
Date: Sat, 15 Jun 2024 02:33:08 +0100
|
|
Subject: [PATCH 01/20] misc: Implement grub_strlcpy()
|
|
|
|
grub_strlcpy() acts the same way as strlcpy() does on most *NIX,
|
|
returning the length of src and ensuring dest is always NUL
|
|
terminated except when size is 0.
|
|
|
|
Signed-off-by: B Horn <b@horn.uk>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
---
|
|
include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 39 insertions(+)
|
|
|
|
diff --git a/include/grub/misc.h b/include/grub/misc.h
|
|
index 6e94d18f5a..e087e7b3e8 100644
|
|
--- a/include/grub/misc.h
|
|
+++ b/include/grub/misc.h
|
|
@@ -64,6 +64,45 @@ grub_stpcpy (char *dest, const char *src)
|
|
return d - 1;
|
|
}
|
|
|
|
+static inline grub_size_t
|
|
+grub_strlcpy (char *dest, const char *src, grub_size_t size)
|
|
+{
|
|
+ char *d = dest;
|
|
+ grub_size_t res = 0;
|
|
+ /*
|
|
+ * We do not subtract one from size here to avoid dealing with underflowing
|
|
+ * the value, which is why to_copy is always checked to be greater than one
|
|
+ * throughout this function.
|
|
+ */
|
|
+ grub_size_t to_copy = size;
|
|
+
|
|
+ /* Copy size - 1 bytes to dest. */
|
|
+ if (to_copy > 1)
|
|
+ while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1)
|
|
+ ;
|
|
+
|
|
+ /*
|
|
+ * NUL terminate if size != 0. The previous step may have copied a NUL byte
|
|
+ * if it reached the end of the string, but we know dest[size - 1] must always
|
|
+ * be a NUL byte.
|
|
+ */
|
|
+ if (size != 0)
|
|
+ dest[size - 1] = '\0';
|
|
+
|
|
+ /* If there is still space in dest, but are here, we reached the end of src. */
|
|
+ if (to_copy > 1)
|
|
+ return res;
|
|
+
|
|
+ /*
|
|
+ * If we haven't reached the end of the string, iterate through to determine
|
|
+ * the strings total length.
|
|
+ */
|
|
+ while (*src++ != '\0' && ++res)
|
|
+ ;
|
|
+
|
|
+ return res;
|
|
+}
|
|
+
|
|
/* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */
|
|
static inline void *
|
|
grub_memcpy (void *dest, const void *src, grub_size_t n)
|
|
--
|
|
2.48.1
|
|
|