GNU GRUB - Bugs: bug #46164, UFS sparse file memset
You are not allowed to post comments on this tracker with your current authentication level.
bug #46164: UFS sparse file memset
Submitter: | Alexander Bluhm <bluhm> | ||
Submitted: | Fri 09 Oct 2015 11:17:18 AM UTC | ||
Category: | Filesystem | Severity: | Major |
Priority: | 5 - Normal | Item Group: | Software Error |
Status: | Fixed | Privacy: | Public |
Assigned to: | None | Originator Name: | |
Open/Closed: | Closed | Release: | Git master |
Release: | Reproducibility: | Every Time | |
Planned Release: | None |
Attached Files
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 3 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2015-10-09 | phcoder | Status | None | Fixed | |
Open/Closed | Open | Closed | |||
2015-10-09 | bluhm | Attached File | - | Added grub.diff, #35122 |
Powered by Savane 3.13-f8d8.
Corresponding source code
When creating a sparse file, that is a file with 0 not written to
disk, on an OpenBSD FFS file system, GRUB does not read it correctly.
The UFS code in GRUB is responsible for reading FFS file systems,
it can handle sparse files, but has a bug there. The second
and third parameters for memset() are exchanged.
It is defined as
void *grub_memset (void *s, int c, grub_size_t len)
but called as
grub_memset (buf, UFS_BLKSZ (sblock) - skipfirst, 0)
Also the length of the buffer is not checked, so the last block
could cause an overflow. The blockend variable seems to contain
the correct length already.
I have found the bug and tested the fix with OpenBSD and GRUB 2.
The git master has the same code.
Alexander Bluhm
--- a/contrib/grub2/grub-core/fs/ufs.c
+++ b/contrib/grub2/grub-core/fs/ufs.c
@@ -394,7 +394,7 @@ grub_ufs_read_file (struct grub_ufs_data *data,
return -1;
}
else
- grub_memset (buf, UFS_BLKSZ (sblock) - skipfirst, 0);
+ grub_memset (buf, 0, blockend);
buf += UFS_BLKSZ (sblock) - skipfirst;
}