mirror of
https://github.com/pbatard/rufus.git
synced 2024-08-14 23:57:05 +00:00
[iso] fix a possible buffer overflow in GetGrubVersion()
* Also increase the size for "probably a flash drive if under" from 32 GB to 128 GB.
This commit is contained in:
parent
ee6c907415
commit
9285313f28
3 changed files with 16 additions and 12 deletions
16
src/iso.c
16
src/iso.c
|
@ -875,17 +875,21 @@ void GetGrubVersion(char* buf, size_t buf_size)
|
||||||
// https://src.fedoraproject.org/rpms/grub2/blob/rawhide/f/0024-Don-t-say-GNU-Linux-in-generated-menus.patch
|
// https://src.fedoraproject.org/rpms/grub2/blob/rawhide/f/0024-Don-t-say-GNU-Linux-in-generated-menus.patch
|
||||||
const char* grub_version_str[] = { "GRUB version %s", "GRUB version %s" };
|
const char* grub_version_str[] = { "GRUB version %s", "GRUB version %s" };
|
||||||
const char* grub_debug_is_enabled_str = "grub_debug_is_enabled";
|
const char* grub_debug_is_enabled_str = "grub_debug_is_enabled";
|
||||||
|
const size_t max_string_size = 32; // The strings above *MUST* be no longer than this value
|
||||||
char *p, unauthorized[] = {'<', '>', ':', '|', '*', '?', '\\', '/'};
|
char *p, unauthorized[] = {'<', '>', ':', '|', '*', '?', '\\', '/'};
|
||||||
size_t i, j;
|
size_t i, j;
|
||||||
BOOL has_grub_debug_is_enabled = FALSE;
|
BOOL has_grub_debug_is_enabled = FALSE;
|
||||||
|
|
||||||
for (i = 0; i < buf_size; i++) {
|
// Make sure we don't overflow our buffer
|
||||||
for (j = 0; j < ARRAYSIZE(grub_version_str); j++) {
|
if (buf_size > max_string_size) {
|
||||||
if (memcmp(&buf[i], grub_version_str[j], strlen(grub_version_str[j]) + 1) == 0)
|
for (i = 0; i < buf_size - max_string_size; i++) {
|
||||||
static_strcpy(img_report.grub2_version, &buf[i + strlen(grub_version_str[j]) + 1]);
|
for (j = 0; j < ARRAYSIZE(grub_version_str); j++) {
|
||||||
|
if (memcmp(&buf[i], grub_version_str[j], strlen(grub_version_str[j]) + 1) == 0)
|
||||||
|
static_strcpy(img_report.grub2_version, &buf[i + strlen(grub_version_str[j]) + 1]);
|
||||||
|
}
|
||||||
|
if (memcmp(&buf[i], grub_debug_is_enabled_str, strlen(grub_debug_is_enabled_str)) == 0)
|
||||||
|
has_grub_debug_is_enabled = TRUE;
|
||||||
}
|
}
|
||||||
if (memcmp(&buf[i], grub_debug_is_enabled_str, strlen(grub_debug_is_enabled_str)) == 0)
|
|
||||||
has_grub_debug_is_enabled = TRUE;
|
|
||||||
}
|
}
|
||||||
// Sanitize the string
|
// Sanitize the string
|
||||||
for (p = &img_report.grub2_version[0]; *p; p++) {
|
for (p = &img_report.grub2_version[0]; *p; p++) {
|
||||||
|
|
10
src/rufus.rc
10
src/rufus.rc
|
@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
|
||||||
IDD_DIALOG DIALOGEX 12, 12, 232, 326
|
IDD_DIALOG DIALOGEX 12, 12, 232, 326
|
||||||
STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
|
STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
|
||||||
EXSTYLE WS_EX_ACCEPTFILES
|
EXSTYLE WS_EX_ACCEPTFILES
|
||||||
CAPTION "Rufus 3.23.2011"
|
CAPTION "Rufus 3.23.2012"
|
||||||
FONT 9, "Segoe UI Symbol", 400, 0, 0x0
|
FONT 9, "Segoe UI Symbol", 400, 0, 0x0
|
||||||
BEGIN
|
BEGIN
|
||||||
LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
|
LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
|
||||||
|
@ -392,8 +392,8 @@ END
|
||||||
//
|
//
|
||||||
|
|
||||||
VS_VERSION_INFO VERSIONINFO
|
VS_VERSION_INFO VERSIONINFO
|
||||||
FILEVERSION 3,23,2011,0
|
FILEVERSION 3,23,2012,0
|
||||||
PRODUCTVERSION 3,23,2011,0
|
PRODUCTVERSION 3,23,2012,0
|
||||||
FILEFLAGSMASK 0x3fL
|
FILEFLAGSMASK 0x3fL
|
||||||
#ifdef _DEBUG
|
#ifdef _DEBUG
|
||||||
FILEFLAGS 0x1L
|
FILEFLAGS 0x1L
|
||||||
|
@ -411,13 +411,13 @@ BEGIN
|
||||||
VALUE "Comments", "https://rufus.ie"
|
VALUE "Comments", "https://rufus.ie"
|
||||||
VALUE "CompanyName", "Akeo Consulting"
|
VALUE "CompanyName", "Akeo Consulting"
|
||||||
VALUE "FileDescription", "Rufus"
|
VALUE "FileDescription", "Rufus"
|
||||||
VALUE "FileVersion", "3.23.2011"
|
VALUE "FileVersion", "3.23.2012"
|
||||||
VALUE "InternalName", "Rufus"
|
VALUE "InternalName", "Rufus"
|
||||||
VALUE "LegalCopyright", "© 2011-2023 Pete Batard (GPL v3)"
|
VALUE "LegalCopyright", "© 2011-2023 Pete Batard (GPL v3)"
|
||||||
VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html"
|
VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html"
|
||||||
VALUE "OriginalFilename", "rufus-3.23.exe"
|
VALUE "OriginalFilename", "rufus-3.23.exe"
|
||||||
VALUE "ProductName", "Rufus"
|
VALUE "ProductName", "Rufus"
|
||||||
VALUE "ProductVersion", "3.23.2011"
|
VALUE "ProductVersion", "3.23.2012"
|
||||||
END
|
END
|
||||||
END
|
END
|
||||||
BLOCK "VarFileInfo"
|
BLOCK "VarFileInfo"
|
||||||
|
|
|
@ -462,7 +462,7 @@ int IsHDD(DWORD DriveIndex, uint16_t vid, uint16_t pid, const char* strid)
|
||||||
score_list[score_list_size] = 15;
|
score_list[score_list_size] = 15;
|
||||||
score += score_list[score_list_size++];
|
score += score_list[score_list_size++];
|
||||||
}
|
}
|
||||||
} else if (drive_size < 32 * GB) {
|
} else if (drive_size < 128 * GB) {
|
||||||
score_list[score_list_size] = -15;
|
score_list[score_list_size] = -15;
|
||||||
score += score_list[score_list_size++];
|
score += score_list[score_list_size++];
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue