]> git.proxmox.com Git - grub2.git/commit
term: Fix overflow on user inputs
authorKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Tue, 7 Jul 2020 19:12:25 +0000 (15:12 -0400)
committerDaniel Kiper <daniel.kiper@oracle.com>
Wed, 29 Jul 2020 14:55:48 +0000 (16:55 +0200)
commit61b7ca08d173adf62facdd6a266cbd2471165e67
treed8b3470aff62502d43655d92aed293b5bcea4ff6
parent16c0dbf4bc6a953c41bc7a031b36dfa8e906afea
term: Fix overflow on user inputs

This requires a very weird input from the serial interface but can cause
an overflow in input_buf (keys) overwriting the next variable (npending)
with the user choice:

(pahole output)

struct grub_terminfo_input_state {
        int                        input_buf[6];         /*     0    24 */
        int                        npending;             /*    24     4 */ <- CORRUPT
        ...snip...

The magic string requires causing this is "ESC,O,],0,1,2,q" and we overflow
npending with "q" (aka increase npending to 161). The simplest fix is to
just to disallow overwrites input_buf, which exactly what this patch does.

Fixes: CID 292449
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/term/terminfo.c