Re: [bug #65880] heap-buffer-overflow in grub-mkrescue.c

Hi,

Vladimir Serbinenko wrote:
> Thomas, savannah just butchers the patch.

Looking in my mailbox ... that line break before "argument" is not by me.

> Can you send it to ML?

I have it ready for grub-devel (git format-patch) and plan to post it
by "git send-email" this evening unless Victoriia Egorova reports that
it does not work.

Whatever, here it is in advance to [email protected].

Have a nice day :)

Thomas

===================================================================

[PATCH 1/1] util/grub-mkrescue: Check existence of option arguments

As reported by Victoriia Egorova in bug 65880, grub-mkrescue does not
verify that the expected argument of an option like -d or -k does really
exist in argv.
So check the loop counter before incrementing it inside the loop which
copies argv to argp_argv. Issue an error message similar to what older
versions of grub-mkrescue did with a missing argument (e.g 2.02).

Fixes: https://savannah.gnu.org/bugs/index.php?65880
Signed-off-by: Thomas Schmitt <[email protected]>
---
 util/grub-mkrescue.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/util/grub-mkrescue.c b/util/grub-mkrescue.c
index abcc1c2f5..8714d819e 100644
--- a/util/grub-mkrescue.c
+++ b/util/grub-mkrescue.c
@@ -477,6 +477,9 @@ main (int argc, char *argv[])
     for (i = 1; i < argc; i++)
       {
 	if (strcmp (argv[i], "-output") == 0) {
+	  if (i + 1 >= argc)
+	    grub_util_error ("%s -- '%s'", _("option requires an argument"),
+	                     argv[i]);
 	  argp_argv[argp_argc++] = (char *) "--output";
 	  i++;
 	  argp_argv[argp_argc++] = argv[i];
@@ -485,6 +488,9 @@ main (int argc, char *argv[])
 	switch (args_to_eat (argv[i]))
 	  {
 	  case 2:
+	    if (i + 1 >= argc)
+	      grub_util_error ("%s -- '%s'", _("option requires an argument"),
+	                       argv[i]);
 	    argp_argv[argp_argc++] = argv[i++];
 	    /* Fallthrough  */
 	  case 1:
--
2.39.2