On 1/12/26 08:29, Avnish Chouhan wrote:
Adding a check for invalid partition number. grub_strtoul() can fail in several scenarios like invalid input, overflow, etc will result in an invalid partition number which could lead to an undefined behavior. Signed-off-by: Avnish Chouhan <[email protected]> --- grub-core/kern/ieee1275/openfw.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/grub-core/kern/ieee1275/openfw.c b/grub-core/kern/ieee1275/openfw.c index 3b492dd..f8ae515 100644 --- a/grub-core/kern/ieee1275/openfw.c +++ b/grub-core/kern/ieee1275/openfw.c @@ -512,7 +512,20 @@ grub_ieee1275_encode_devname (const char *path) } if (partition && partition[0]) { - unsigned int partno = grub_strtoul (partition, 0, 0); + char *endptr; + + unsigned long partno = grub_strtoul (partition, &endptr, 0);
I recommend setting the base instead of letting it be 0. An input string of "[" would be accepted as the number 43.
+ grub_errno = GRUB_ERR_NONE;
I believe grub_errno should be set before the call to strtoul() instead of after it. Setting grub_errno before would allow you to use it as part of your error checking below.
Regards, Nicholas Vinson
+ + if (*endptr != '\0' || partno > 65535 || + (partno == 0 && ! grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_0_BASED_PARTITIONS))) + { + grub_free (partition); + grub_free (device); + grub_free (encoding); + grub_error (GRUB_ERR_BAD_ARGUMENT, N_("invalid partition number")); + return NULL; + }*optr++ = ','; @@ -520,7 +533,7 @@ grub_ieee1275_encode_devname (const char *path)/* GRUB partition 1 is OF partition 0. */ partno++;- grub_snprintf (optr, sizeof ("XXXXXXXXXXXX"), "%d", partno);+ grub_snprintf (optr, sizeof ("XXXXXXXXXXXX"), "%lu", partno); } else *optr = '\0';
_______________________________________________ Grub-devel mailing list [email protected] https://lists.gnu.org/mailman/listinfo/grub-devel
