Hello, GRUB development has moved to freedesktop.org. Please submit patches there.
https://gitlab.freedesktop.org/gnu-grub/grub/ Thanks, Andrew On Sun, Oct 25, 2026 at 12:42 AM YuziO2 <[email protected]> wrote: > Commit 8c95307a0 (fs/ntfs: Correct possible access violations) added a > check that the run list offset of a non-resident attribute stays inside > the attribute. However, end_ptr is computed as pa + len, where len is > the number of bytes the caller asked to read, not the length of the > attribute. Any read shorter than the run list offset (0x40 for an > unnamed $DATA attribute) therefore fails with "run offset out of range", > even on a valid file system. > > Most readers go through bufio and request larger blocks, so they are not > affected. Unbuffered small reads are: "file --is-hibernated-hiberfil" > reads 4 bytes and so always returns false for hiberfil.sys on a real > Windows installation, where the file is non-resident. > > Use the attribute length from the attribute header instead. The existing > check against at->end still keeps the run list inside the MFT record > buffer. > > Fixes: 8c95307a0 (fs/ntfs: Correct possible access violations) > Signed-off-by: YuziO2 <[email protected]> > --- > Tested on x86_64-efi in QEMU/OVMF with a full build of master (this patch > on top of b07cc37ca, default -Werror), against a small NTFS volume holding > non-resident files: > > before after > file --is-hibernated-hiberfil (HIBR) false* true > source of a 2 KiB config file ok ok > loadfont of a pf2 font ok ok > background_image of a PNG ok ok > > * error: ../../grub-core/fs/ntfs.c:read_data:722:run offset out of range. > > The same before/after results were obtained with GRUB 2.14. > > On real hardware, a 4 KiB read of the non-resident, 13 GB hiberfil.sys of > a hibernated Windows installation returns the HIBR signature. > > grub-core/fs/ntfs.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c > index bb3cec4e6..986adc44d 100644 > --- a/grub-core/fs/ntfs.c > +++ b/grub-core/fs/ntfs.c > @@ -683,7 +683,7 @@ read_data (struct grub_ntfs_attr *at, grub_uint8_t > *pa, grub_uint8_t *dest, > grub_disk_read_hook_t read_hook, void *read_hook_data) > { > struct grub_ntfs_rlst cc, *ctx; > - grub_uint8_t *end_ptr = (pa + len); > + grub_uint8_t *end_ptr = pa + u32at (pa, 4); > grub_uint16_t run_offset; > > if (len == 0) > > base-commit: b07cc37ca64fe99260884e7325abc333374e098b > -- > 2.55.0 > >
_______________________________________________ Grub-devel mailing list [email protected] https://lists.gnu.org/mailman/listinfo/grub-devel
