commands/read: Fix an integer overflow when supplying more than 2^31 characters
authorJonathan Bar Or <jonathanbaror@gmail.com>
Thu, 23 Jan 2025 18:17:05 +0000 (19:17 +0100)
committerFelix Zielcke <fzielcke@z-51.de>
Thu, 3 Jul 2025 16:35:51 +0000 (18:35 +0200)
commitd94ed65f7d4fed4f719b1154eb17e5174c05245e
treefb1f85c67081569786c3234cd7a2818ad9254394
parente09d75212cd54c2b3b8b2980ac9131b059885fd2
commands/read: Fix an integer overflow when supplying more than 2^31 characters

The grub_getline() function currently has a signed integer variable "i"
that can be overflown when user supplies more than 2^31 characters.
It results in a memory corruption of the allocated line buffer as well
as supplying large negative values to grub_realloc().

Fixes: CVE-2025-0690
Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
Signed-off-by: Jonathan Bar Or <jonathanbaror@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name commands-read-Fix-an-integer-overflow-when-supplying-more.patch
grub-core/commands/read.c