font: Assign null_font to glyphs in ascii_font_glyph[]

The calculations in blit_comb() need information from glyph's font, e.g.
grub_font_get_xheight(main_glyph->font). However, main_glyph->font is
NULL if main_glyph comes from ascii_font_glyph[]. Therefore
grub_font_get_*() crashes because of NULL pointer.

There is already a solution, the null_font. So, assign it to those glyphs
in ascii_font_glyph[].

Reported-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

diff --git a/debian/patches/cve_2022_2601/0013-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch b/debian/patches/cve_2022_2601/0013-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
new file mode 100644 (file)
index 0000000..2db665f
--- /dev/null
+++ b/debian/patches/cve_2022_2601/0013-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
@@ -0,0 +1,36 @@
+From dd539d695482069d28b40f2d3821f710cdcf6ee6 Mon Sep 17 00:00:00 2001
+From: Zhang Boyang <zhangboyang.id@gmail.com>
+Date: Fri, 28 Oct 2022 17:29:16 +0800
+Subject: [PATCH 13/14] font: Assign null_font to glyphs in ascii_font_glyph[]
+
+The calculations in blit_comb() need information from glyph's font, e.g.
+grub_font_get_xheight(main_glyph->font). However, main_glyph->font is
+NULL if main_glyph comes from ascii_font_glyph[]. Therefore
+grub_font_get_*() crashes because of NULL pointer.
+
+There is already a solution, the null_font. So, assign it to those glyphs
+in ascii_font_glyph[].
+
+Reported-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/font/font.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/font/font.c b/grub-core/font/font.c
+index cf15dc2f9..3821937e6 100644
+--- a/grub-core/font/font.c
++++ b/grub-core/font/font.c
+@@ -137,7 +137,7 @@ ascii_glyph_lookup (grub_uint32_t code)
+         ascii_font_glyph[current]->offset_x = 0;
+         ascii_font_glyph[current]->offset_y = -2;
+         ascii_font_glyph[current]->device_width = 8;
+-        ascii_font_glyph[current]->font = NULL;
++        ascii_font_glyph[current]->font = &null_font;
+ 
+         grub_memcpy (ascii_font_glyph[current]->bitmap,
+                      &ascii_bitmaps[current * ASCII_BITMAP_SIZE],
+-- 
+2.30.2
+

diff --git a/grub-core/font/font.c b/grub-core/font/font.c
index 29fbb942949b586df83b8621e0064ce5d7a93bb3..e6616e610c9716f400161f4f915d898cff9d8b4f 100644 (file)
--- a/grub-core/font/font.c
+++ b/grub-core/font/font.c
@@ -137,7 +137,7 @@ ascii_glyph_lookup (grub_uint32_t code)
          ascii_font_glyph[current]->offset_x = 0;
          ascii_font_glyph[current]->offset_y = -2;
          ascii_font_glyph[current]->device_width = 8;
-         ascii_font_glyph[current]->font = NULL;
+         ascii_font_glyph[current]->font = &null_font;
 
          grub_memcpy (ascii_font_glyph[current]->bitmap,
                       &ascii_bitmaps[current * ASCII_BITMAP_SIZE],