From: Daniel Axtens <d...@axtens.net> rlocn->offset is read directly from disk and added to the metadatabuf pointer to create a pointer to a block of metadata. It's a 64-bit quantity so as long as you don't overflow you can set subsequent pointers to point anywhere in memory.
Require that rlocn->offset fits within the metadata buffer size. Signed-off-by: Daniel Axtens <d...@axtens.net> Reviewed-by: Daniel Kiper <daniel.ki...@oracle.com> --- grub-core/disk/lvm.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c index 7efbaec79..4e17b8897 100644 --- a/grub-core/disk/lvm.c +++ b/grub-core/disk/lvm.c @@ -248,6 +248,14 @@ grub_lvm_detect (grub_disk_t disk, } rlocn = mdah->raw_locns; + if (grub_le_to_cpu64 (rlocn->offset) >= grub_le_to_cpu64 (mda_size)) + { +#ifdef GRUB_UTIL + grub_util_info ("metadata offset is beyond end of metadata area"); +#endif + goto fail2; + } + if (grub_le_to_cpu64 (rlocn->offset) + grub_le_to_cpu64 (rlocn->size) > grub_le_to_cpu64 (mdah->size)) { -- 2.11.0 _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel