nerd
/
rufus
mirror of https://github.com/pbatard/rufus.git
1
1
Fork 0
Code Issues 1 Projects Releases Wiki Activity

[iso] fix a possible buffer overflow in GetGrubVersion() 

* Also increase the size for "probably a flash drive if under" from 32 GB to 128 GB.
This commit is contained in:
Pete Batard 2023-04-01 14:39:25 +02:00
parent ee6c907415
commit 9285313f28
No known key found for this signature in database
GPG Key ID: 38E0CF5E69EDD671
3 changed files with 16 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/iso.c
View File

@ -875,17 +875,21 @@ void GetGrubVersion(char* buf, size_t buf_size)
// https://src.fedoraproject.org/rpms/grub2/blob/rawhide/f/0024-Don-t-say-GNU-Linux-in-generated-menus.patch
const char* grub_version_str[] = { "GRUB version %s", "GRUB version %s" };
const char* grub_debug_is_enabled_str = "grub_debug_is_enabled";
const size_t max_string_size = 32; // The strings above *MUST* be no longer than this value
char *p, unauthorized[] = {'<', '>', ':', '|', '*', '?', '\\', '/'};
size_t i, j;
BOOL has_grub_debug_is_enabled = FALSE;
for (i = 0; i < buf_size; i++) {
for (j = 0; j < ARRAYSIZE(grub_version_str); j++) {
if (memcmp(&buf[i], grub_version_str[j], strlen(grub_version_str[j]) + 1) == 0)
static_strcpy(img_report.grub2_version, &buf[i + strlen(grub_version_str[j]) + 1]);
// Make sure we don't overflow our buffer
if (buf_size > max_string_size) {
for (i = 0; i < buf_size - max_string_size; i++) {
for (j = 0; j < ARRAYSIZE(grub_version_str); j++) {
if (memcmp(&buf[i], grub_version_str[j], strlen(grub_version_str[j]) + 1) == 0)
static_strcpy(img_report.grub2_version, &buf[i + strlen(grub_version_str[j]) + 1]);
}
if (memcmp(&buf[i], grub_debug_is_enabled_str, strlen(grub_debug_is_enabled_str)) == 0)
has_grub_debug_is_enabled = TRUE;
}
if (memcmp(&buf[i], grub_debug_is_enabled_str, strlen(grub_debug_is_enabled_str)) == 0)
has_grub_debug_is_enabled = TRUE;
}
// Sanitize the string
for (p = &img_report.grub2_version[0]; *p; p++) {

10
src/rufus.rc
View File

@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
IDD_DIALOG DIALOGEX 12, 12, 232, 326
STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_ACCEPTFILES
CAPTION "Rufus 3.23.2011"
CAPTION "Rufus 3.23.2012"
FONT 9, "Segoe UI Symbol", 400, 0, 0x0
BEGIN
LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
@ -392,8 +392,8 @@ END
//
VS_VERSION_INFO VERSIONINFO
FILEVERSION 3,23,2011,0
PRODUCTVERSION 3,23,2011,0
FILEVERSION 3,23,2012,0
PRODUCTVERSION 3,23,2012,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
@ -411,13 +411,13 @@ BEGIN
VALUE "Comments", "https://rufus.ie"
VALUE "CompanyName", "Akeo Consulting"
VALUE "FileDescription", "Rufus"
VALUE "FileVersion", "3.23.2011"
VALUE "FileVersion", "3.23.2012"
VALUE "InternalName", "Rufus"
VALUE "LegalCopyright", "© 2011-2023 Pete Batard (GPL v3)"
VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html"
VALUE "OriginalFilename", "rufus-3.23.exe"
VALUE "ProductName", "Rufus"
VALUE "ProductVersion", "3.23.2011"
VALUE "ProductVersion", "3.23.2012"
END
END
BLOCK "VarFileInfo"

2
src/smart.c
View File

@ -462,7 +462,7 @@ int IsHDD(DWORD DriveIndex, uint16_t vid, uint16_t pid, const char* strid)
score_list[score_list_size] = 15;
score += score_list[score_list_size++];
}
} else if (drive_size < 32 * GB) {
} else if (drive_size < 128 * GB) {
score_list[score_list_size] = -15;
score += score_list[score_list_size++];
}