commands/read: Fix an integer overflow when supplying more than 2^31 characters
authorJonathan Bar Or <jonathanbaror@gmail.com>
Thu, 23 Jan 2025 18:17:05 +0000 (19:17 +0100)
committerMiao Wang <shankerwangmiao@gmail.com>
Sun, 15 Feb 2026 13:50:20 +0000 (13:50 +0000)
commit9d2de8159287c08f3cf5dbb14435761afbc2084f
treeb17394eb5273f75072a9d7597582c8bb5da9caa8
parent2b6e04b2655d7896fe2f9fe126dfa3b21c492d83
commands/read: Fix an integer overflow when supplying more than 2^31 characters

The grub_getline() function currently has a signed integer variable "i"
that can be overflown when user supplies more than 2^31 characters.
It results in a memory corruption of the allocated line buffer as well
as supplying large negative values to grub_realloc().

Fixes: CVE-2025-0690
Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
Signed-off-by: Jonathan Bar Or <jonathanbaror@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name commands-read-Fix-an-integer-overflow-when-supplying-more.patch
grub-core/commands/read.c