From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1ojdE1-0000Mv-KL for mharc-grub-devel@gnu.org; Sat, 15 Oct 2022 05:12:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:52420) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ojdDz-0000Mk-Ud for grub-devel@gnu.org; Sat, 15 Oct 2022 05:12:55 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:55351) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ojdDx-0005xl-73 for grub-devel@gnu.org; Sat, 15 Oct 2022 05:12:55 -0400 Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id 238705C00A0; Sat, 15 Oct 2022 05:12:52 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute3.internal (MEProxy); Sat, 15 Oct 2022 05:12:52 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pks.im; h=cc:cc :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm3; t=1665825172; x=1665911572; bh=n/HU9HTA+B lKg+M9HX1f5YNqgJccMtbdKkVOp2xG88c=; b=nzBpUOL3P3TyC4194fq2oGVqiP KiRkNjjuiXgmdsaa+PHv3aw4pnxH/KMAw0xRO1UibrxHHxgTUp9lcEJPQMlEvIvA x4kZeH7FzonY2CD3UN4DQXiL++wCbfJG1v1MiQuUaJFe34nlB3V34vvQtgabyxgr RbXFD/JsDY9EZKnRkTjNzBHoe1FaTG4S0vsWOuvYI+y+8g1fPmYjBoFUyqMxf3+y FH0NGTxkstdjStzAFj/x9Yxyv5ZWSq65TGEw/dtAQosK4/gz/GpAUnmmrPr+Am/5 GyAzYgDdikRwI/6xQHCd2y/3Cu19WQ/etMcWVc9+Kv6+A1UQOCPsG/mMNnoQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:date:date:feedback-id :feedback-id:from:from:in-reply-to:in-reply-to:message-id :mime-version:references:reply-to:sender:subject:subject:to:to :x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; t=1665825172; x=1665911572; bh=n/HU9HTA+BlKg+M9HX1f5YNqgJcc MtbdKkVOp2xG88c=; b=s3qNSNVLVuROj1P0RE9LgbWC81/dkPf8e+bja8QtcDnH +0uTY+5ikcDDki57UxZhK98mBPka9SOqnhz2rBda7piphmMpbQjxO5lW5pwyYM6Z G9CKUcsrFvsK9zyunR65sNnchL0Dd+avpdKCKDAjjb7pL6z0FknAmOiawRZ60HwF Bq/6F75JLNXa87w2dF8g+sf4qrQVwviqQ4Vcv2S69FdYaZOZLUmq5zTdyYGih7fc FAft5JokVuAYM0pKkQiCt4xplPsLAAyPNy2vWi2nxsuicQFnTRh+rTZyKw/QqOpP gYt5zwWcCqhb6JJ5L/VfTp5FPRk7d1cryIBqi7mTVw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvfedrfeekgedgudefucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepfffhvfevuffkfhggtggujgesghdtreertddtvdenucfhrhhomheprfgrthhr ihgtkhcuufhtvghinhhhrghrughtuceophhssehpkhhsrdhimheqnecuggftrfgrthhtvg hrnhepueektdevtdffveeljeetgfehheeigeekleduvdeffeeghefgledttdehjeelffet necuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepphhsse hpkhhsrdhimh X-ME-Proxy: Feedback-ID: i197146af:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sat, 15 Oct 2022 05:12:50 -0400 (EDT) Received: by pks.im (OpenSMTPD) with ESMTPSA id 5e8f9497 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Sat, 15 Oct 2022 09:12:48 +0000 (UTC) Date: Sat, 15 Oct 2022 11:13:09 +0200 From: Patrick Steinhardt To: Alec Brown Cc: grub-devel@gnu.org, daniel.kiper@oracle.com, darren.kenny@oracle.com, development@efficientek.com Subject: Re: [PATCH v2] grub-core/disk/cryptodisk.c: Fix unintentional integer overflow Message-ID: References: <1665784028-11871-1-git-send-email-alec.r.brown@oracle.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="AVgFqNYSX3vjPXbZ" Content-Disposition: inline In-Reply-To: <1665784028-11871-1-git-send-email-alec.r.brown@oracle.com> Received-SPF: pass client-ip=66.111.4.26; envelope-from=ps@pks.im; helo=out2-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Oct 2022 09:12:56 -0000 --AVgFqNYSX3vjPXbZ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Oct 14, 2022 at 05:47:08PM -0400, Alec Brown wrote: > In the function grub_cryptodisk_endecrypt(), a for loop is incrementing t= he > variable i by (1U << log_sector_size). The variable i is of type grub_siz= e_t > which is a 64-bit unsigned integer on x86_64 architecture. On the other h= and, 1U > is a 32-bit unsigned integer. By performing a left shift on a 32-bit valu= e and > assigning it to a 64-bit variable, the 64-bit variable may have incorrect= values > in the high 32-bits if the shift has an overflow. To avoid this, we repla= ce 1U > with (grub_size_t) 1. >=20 > Fixes: CID 307788 >=20 > Signed-off-by: Alec Brown Reviewed-by: Patrick Steinhardt > --- >=20 > There was a mistake in v1 of the commit message describing the issue in t= he > code. This version fixes the commit message so that it's accurate. >=20 > grub-core/disk/cryptodisk.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) >=20 > diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c > index 9f5dc7acb..cdcb882ca 100644 > --- a/grub-core/disk/cryptodisk.c > +++ b/grub-core/disk/cryptodisk.c > @@ -239,7 +239,7 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *de= v, > return (do_encrypt ? grub_crypto_ecb_encrypt (dev->cipher, data, dat= a, len) > : grub_crypto_ecb_decrypt (dev->cipher, data, data, len)); > =20 > - for (i =3D 0; i < len; i +=3D (1U << log_sector_size)) > + for (i =3D 0; i < len; i +=3D ((grub_size_t) 1 << log_sector_size)) > { > grub_size_t sz =3D ((dev->cipher->cipher->blocksize > + sizeof (grub_uint32_t) - 1) > --=20 > 2.27.0 >=20 --AVgFqNYSX3vjPXbZ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEF9hrgiFbCdvenl/rVbJhu7ckPpQFAmNKeaQACgkQVbJhu7ck PpQQIg//TxXs0tldTTN3FMqUIPz7Ohq2agmjls/VGsaKo6xrxIaTYn5HwzEEt4xv J3vgI0ZsfqfHoydRM4RV913GE8pOuhaDBeETA741xMOho3m8kZlLEv7B1zhPNdeo nsa9Gxlalkb78EUSWyu9uj1EpUAVaNgkHwgCOC3/RU/uEDvvvQ/QVibCNQT5HCUY Adei2pWznU4guQFSnmp8m6YSAdSyv7lJ0pg6weWCeriyrzMNyIgbVWhr5Vc7rMod ph9sBilQxsEYNBR9ssWURkD2cKDdJ8d9iddn1EPyGVQ9ey2tt1fNk2sHx9iXeW0Y tThzsAGuvWQ5GEDZMPEihBt0wy07i5ToM62L8hCAoIauHCRfZ0voPYSK2Ov4YjgS /XkBTnvEqTNM67UTJ1/CrrFeETtIKuoycLxctxCZfQEoDTIr2kVzhn5wl0HMS1Em Mxh+cK0BPT6BWznV0RXCMUL0sk94zF8Z3OJKP2gFwD78ipDuYsfBc7xLu3OQFGNz /9odSPKLTmI2+/g1kb7Rm9IDM5ETzHwtXCWFiryV0rUBAQvJWSbvg4y0/Raqy174 zShqGwO8v2T6pVzkvLGKiHYwvY9j5AdyQzlFBDAfWLddnS47l6MKA+FO6qT2TrK4 R80JZ6TPg97tPiPD0+Mry6GwXE90l1TI6yidWjHsXEIH3kHey7s= =QFRe -----END PGP SIGNATURE----- --AVgFqNYSX3vjPXbZ--