diff mbox series

BUG: buffer overflow in grub env code

Message ID 20190315103909.4156-1-sbabic@denx.de
State Accepted
Headers show
Series BUG: buffer overflow in grub env code | expand

Commit Message

Stefano Babic March 15, 2019, 10:39 a.m. UTC 
The size is estimated before iterating the variables, but then each
variable is copied in a fixed-size buffer (256 bytes). If a variable is
larger as 256 bytes, a buffer overflow happens.

Signed-off-by: Stefano Babic <sbabic@denx.de>
---
 bootloader/grub.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/bootloader/grub.c b/bootloader/grub.c
index 414c759..6a03d2b 100644
--- a/bootloader/grub.c
+++ b/bootloader/grub.c
@@ -165,7 +165,7 @@  static inline void grubenv_update_size(struct grubenv_t *grubenv)
 static int grubenv_write(struct grubenv_t *grubenv)
 {
 	FILE *fp = NULL;
-	char *buf = NULL, *ptr, line[SWUPDATE_GENERAL_STRING_SIZE];
+	char *buf = NULL, *ptr;
 	struct dict_entry *grubvar;
 	int ret = 0, llen = 0;
 
@@ -198,11 +198,17 @@  static int grubenv_write(struct grubenv_t *grubenv)
 	LIST_FOREACH(grubvar, &grubenv->vars, next) {
 		char *key = dict_entry_get_key(grubvar);
 		char *value = dict_entry_get_value(grubvar);
+		char *tmp;
 
 		llen = strlen(key) + strlen(value) + 2;
 		/* +1 for null termination */
-		snprintf(line, llen + 1, "%s=%s\n", key, value);
-		strncat(buf, line, llen);
+		ret = asprintf(&tmp, "%s=%s\n", key, value);
+		if (ret == ENOMEM_ASPRINTF) {
+			ERROR("OOM when copying Grub Env");
+			goto cleanup;
+		}
+		strncat(buf, tmp, llen);
+		free(tmp);
 	}
 
 	/* # chars starts there */