In grub-core/loader/multiboot_elfxx.c, space is being allocated for the section
header region, but isn't verifying if the region is within the file's size.
Before calling grub_calloc(), we can add a conditional to check if the section
header region is smaller than the file size.
Fixes: CID 314029
Fixes: CID 314038
Signed-off-by: Alec Brown <alec.r.br...@oracle.com>
---
grub-core/loader/multiboot_elfxx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/grub-core/loader/multiboot_elfxx.c
b/grub-core/loader/multiboot_elfxx.c
index 69f567588..52eaf9184 100644
--- a/grub-core/loader/multiboot_elfxx.c
+++ b/grub-core/loader/multiboot_elfxx.c
@@ -248,6 +248,9 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
{
grub_uint8_t *shdr, *shdrptr;
+ if ((grub_off_t) ehdr->e_shoff + shnum * ehdr->e_shentsize >
grub_file_size (mld->file))
+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("ELF section header region
is larger than the file size"));
+
shdr = grub_calloc (shnum, ehdr->e_shentsize);
if (!shdr)
return grub_errno;
--
2.27.0
_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel
