nerd
/
rufus
mirror of https://github.com/pbatard/rufus.git
1
1
Fork 0
Code Issues 1 Projects Releases Wiki Activity

[iso] fix a possible buffer overflow in GetGrubVersion() 

* Also increase the size for "probably a flash drive if under" from 32 GB to 128 GB.
This commit is contained in:
Pete Batard 2023-04-01 14:39:25 +02:00
parent ee6c907415
commit 9285313f28
No known key found for this signature in database
GPG Key ID: 38E0CF5E69EDD671
3 changed files with 16 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/iso.c
View File

@ -875,17 +875,21 @@ void GetGrubVersion(char* buf, size_t buf_size)
// https://src.fedoraproject.org/rpms/grub2/blob/rawhide/f/0024-Don-t-say-GNU-Linux-in-generated-menus.patch // https://src.fedoraproject.org/rpms/grub2/blob/rawhide/f/0024-Don-t-say-GNU-Linux-in-generated-menus.patch
const char* grub_version_str[] = { "GRUB version %s", "GRUB version %s" }; const char* grub_version_str[] = { "GRUB version %s", "GRUB version %s" };
const char* grub_debug_is_enabled_str = "grub_debug_is_enabled"; const char* grub_debug_is_enabled_str = "grub_debug_is_enabled";
const size_t max_string_size = 32; // The strings above *MUST* be no longer than this value
char *p, unauthorized[] = {'<', '>', ':', '|', '*', '?', '\\', '/'}; char *p, unauthorized[] = {'<', '>', ':', '|', '*', '?', '\\', '/'};
size_t i, j; size_t i, j;
BOOL has_grub_debug_is_enabled = FALSE; BOOL has_grub_debug_is_enabled = FALSE;
for (i = 0; i < buf_size; i++) { // Make sure we don't overflow our buffer
for (j = 0; j < ARRAYSIZE(grub_version_str); j++) { if (buf_size > max_string_size) {
if (memcmp(&buf[i], grub_version_str[j], strlen(grub_version_str[j]) + 1) == 0) for (i = 0; i < buf_size - max_string_size; i++) {
static_strcpy(img_report.grub2_version, &buf[i + strlen(grub_version_str[j]) + 1]); for (j = 0; j < ARRAYSIZE(grub_version_str); j++) {
if (memcmp(&buf[i], grub_version_str[j], strlen(grub_version_str[j]) + 1) == 0)
static_strcpy(img_report.grub2_version, &buf[i + strlen(grub_version_str[j]) + 1]);
}
if (memcmp(&buf[i], grub_debug_is_enabled_str, strlen(grub_debug_is_enabled_str)) == 0)
has_grub_debug_is_enabled = TRUE;
} }
if (memcmp(&buf[i], grub_debug_is_enabled_str, strlen(grub_debug_is_enabled_str)) == 0)
has_grub_debug_is_enabled = TRUE;
} }
// Sanitize the string // Sanitize the string
for (p = &img_report.grub2_version[0]; *p; p++) { for (p = &img_report.grub2_version[0]; *p; p++) {

10
src/rufus.rc
View File

@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
IDD_DIALOG DIALOGEX 12, 12, 232, 326 IDD_DIALOG DIALOGEX 12, 12, 232, 326
STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_ACCEPTFILES EXSTYLE WS_EX_ACCEPTFILES
CAPTION "Rufus 3.23.2011" CAPTION "Rufus 3.23.2012"
FONT 9, "Segoe UI Symbol", 400, 0, 0x0 FONT 9, "Segoe UI Symbol", 400, 0, 0x0
BEGIN BEGIN
LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
@ -392,8 +392,8 @@ END
// //
VS_VERSION_INFO VERSIONINFO VS_VERSION_INFO VERSIONINFO
FILEVERSION 3,23,2011,0 FILEVERSION 3,23,2012,0
PRODUCTVERSION 3,23,2011,0 PRODUCTVERSION 3,23,2012,0
FILEFLAGSMASK 0x3fL FILEFLAGSMASK 0x3fL
#ifdef _DEBUG #ifdef _DEBUG
FILEFLAGS 0x1L FILEFLAGS 0x1L
@ -411,13 +411,13 @@ BEGIN
VALUE "Comments", "https://rufus.ie" VALUE "Comments", "https://rufus.ie"
VALUE "CompanyName", "Akeo Consulting" VALUE "CompanyName", "Akeo Consulting"
VALUE "FileDescription", "Rufus" VALUE "FileDescription", "Rufus"
VALUE "FileVersion", "3.23.2011" VALUE "FileVersion", "3.23.2012"
VALUE "InternalName", "Rufus" VALUE "InternalName", "Rufus"
VALUE "LegalCopyright", "© 2011-2023 Pete Batard (GPL v3)" VALUE "LegalCopyright", "© 2011-2023 Pete Batard (GPL v3)"
VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html" VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html"
VALUE "OriginalFilename", "rufus-3.23.exe" VALUE "OriginalFilename", "rufus-3.23.exe"
VALUE "ProductName", "Rufus" VALUE "ProductName", "Rufus"
VALUE "ProductVersion", "3.23.2011" VALUE "ProductVersion", "3.23.2012"
END END
END END
BLOCK "VarFileInfo" BLOCK "VarFileInfo"

2
src/smart.c
View File

@ -462,7 +462,7 @@ int IsHDD(DWORD DriveIndex, uint16_t vid, uint16_t pid, const char* strid)
score_list[score_list_size] = 15; score_list[score_list_size] = 15;
score += score_list[score_list_size++]; score += score_list[score_list_size++];
} }
} else if (drive_size < 32 * GB) { } else if (drive_size < 128 * GB) {
score_list[score_list_size] = -15; score_list[score_list_size] = -15;
score += score_list[score_list_size++]; score += score_list[score_list_size++];
} }