commands/read: Fix an integer overflow when supplying more than 2^31 characters
authorJonathan Bar Or <jonathanbaror@gmail.com>
Thu, 23 Jan 2025 18:17:05 +0000 (19:17 +0100)
committerFelix Zielcke <fzielcke@z-51.de>
Wed, 11 Jun 2025 15:42:34 +0000 (17:42 +0200)
commitc51e33a6ed454670ba2b8c28e1538e086058b4dc
treed34429ca4083fc00d942b8c25ba1aa074467c74b
parentae3314c1291c62d31d8d0b3a208e00bc2b208d3f
commands/read: Fix an integer overflow when supplying more than 2^31 characters

The grub_getline() function currently has a signed integer variable "i"
that can be overflown when user supplies more than 2^31 characters.
It results in a memory corruption of the allocated line buffer as well
as supplying large negative values to grub_realloc().

Fixes: CVE-2025-0690
Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
Signed-off-by: Jonathan Bar Or <jonathanbaror@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name commands-read-Fix-an-integer-overflow-when-supplying-more.patch
grub-core/commands/read.c