diff options
| author | Daniel Axtens <dja@axtens.net> | 2021-07-13 13:24:38 +1000 |
|---|---|---|
| committer | Daniel Kiper <daniel.kiper@oracle.com> | 2022-06-07 16:39:32 +0200 |
| commit | 830a9628b2c9e1b6388af624aaf4a80818ed6be0 (patch) | |
| tree | c22487417848f5a9436b1e61cb3713e002e8ec4a | |
| parent | 22a3f97d39f6a10b08ad7fd1cc47c4dcd10413f6 (diff) | |
| download | grub-830a9628b2c9e1b6388af624aaf4a80818ed6be0.tar.gz | |
normal/charset: Fix array out-of-bounds formatting unicode for display
In some cases attempting to display arbitrary binary strings leads
to ASAN splats reading the widthspec array out of bounds.
Check the index. If it would be out of bounds, return a width of 1.
I don't know if that's strictly correct, but we're not really expecting
great display of arbitrary binary data, and it's certainly not worse than
an OOB read.
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
| -rw-r--r-- | grub-core/normal/charset.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c index 7778f1a99..000e687bd 100644 --- a/grub-core/normal/charset.c +++ b/grub-core/normal/charset.c @@ -395,6 +395,8 @@ grub_unicode_estimate_width (const struct grub_unicode_glyph *c) { if (grub_unicode_get_comb_type (c->base)) return 0; + if (((unsigned long) (c->base >> 3)) >= ARRAY_SIZE (widthspec)) + return 1; if (widthspec[c->base >> 3] & (1 << (c->base & 7))) return 2; else |