mirrors/rufus
1
0
Fork 0
mirror of https://github.com/pbatard/rufus.git synced 2025-06-01 23:38:30 -04:00
Code Issues Projects Releases Packages Wiki Activity

[iso] fix a possible buffer overflow in GetGrubVersion()

Browse source 
* Also increase the size for "probably a flash drive if under" from 32 GB to 128 GB.
This commit is contained in:
Pete Batard 2023-04-01 14:39:25 +02:00
parent ee6c907415
commit 9285313f28
No known key found for this signature in database
GPG key ID: 38E0CF5E69EDD671
3 changed files with 16 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/iso.c
View file

@ -875,17 +875,21 @@ void GetGrubVersion(char* buf, size_t buf_size)
// https://src.fedoraproject.org/rpms/grub2/blob/rawhide/f/0024-Don-t-say-GNU-Linux-in-generated-menus.patch
const char* grub_version_str[] = { "GRUB version %s", "GRUB version %s" };
const char* grub_debug_is_enabled_str = "grub_debug_is_enabled";
const size_t max_string_size = 32; // The strings above *MUST* be no longer than this value
char *p, unauthorized[] = {'<', '>', ':', '|', '*', '?', '\\', '/'};
size_t i, j;
BOOL has_grub_debug_is_enabled = FALSE;
for (i = 0; i < buf_size; i++) {
for (j = 0; j < ARRAYSIZE(grub_version_str); j++) {
if (memcmp(&buf[i], grub_version_str[j], strlen(grub_version_str[j]) + 1) == 0)
static_strcpy(img_report.grub2_version, &buf[i + strlen(grub_version_str[j]) + 1]);
// Make sure we don't overflow our buffer
if (buf_size > max_string_size) {
for (i = 0; i < buf_size - max_string_size; i++) {
for (j = 0; j < ARRAYSIZE(grub_version_str); j++) {
if (memcmp(&buf[i], grub_version_str[j], strlen(grub_version_str[j]) + 1) == 0)
static_strcpy(img_report.grub2_version, &buf[i + strlen(grub_version_str[j]) + 1]);
}
if (memcmp(&buf[i], grub_debug_is_enabled_str, strlen(grub_debug_is_enabled_str)) == 0)
has_grub_debug_is_enabled = TRUE;
}
if (memcmp(&buf[i], grub_debug_is_enabled_str, strlen(grub_debug_is_enabled_str)) == 0)
has_grub_debug_is_enabled = TRUE;
}
// Sanitize the string
for (p = &img_report.grub2_version[0]; *p; p++) {