From: Daniel Axtens <d...@axtens.net> Fuzzing found the following crash:
search -hhhhhhhhhhhhhf We didn't allocate enough option space for 13 hints because the allocation code counts the number of discrete arguments (i.e. argc). However, the shortopt parsing code will happily keep processing a combination of short options without checking if those short options require an argument. This means you can easily end writing past the allocated option space. This fixes a OOB write which can cause heap corruption. Fixes: CVE-2021-20225 Reported-by: Daniel Axtens <d...@axtens.net> Signed-off-by: Daniel Axtens <d...@axtens.net> Reviewed-by: Daniel Kiper <daniel.ki...@oracle.com> --- grub-core/lib/arg.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/grub-core/lib/arg.c b/grub-core/lib/arg.c index 8439a0062..ade82d5dc 100644 --- a/grub-core/lib/arg.c +++ b/grub-core/lib/arg.c @@ -299,6 +299,19 @@ grub_arg_parse (grub_extcmd_t cmd, int argc, char **argv, it can have an argument value. */ if (*curshort) { + /* + * Only permit further short opts if this one doesn't + * require a value. + */ + if (opt->type != ARG_TYPE_NONE && + !(opt->flags & GRUB_ARG_OPTION_OPTIONAL)) + { + grub_error (GRUB_ERR_BAD_ARGUMENT, + N_("missing mandatory option for `%s'"), + opt->longarg); + goto fail; + } + if (parse_option (cmd, opt, 0, usr) || grub_errno) goto fail; } -- 2.11.0 _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel