From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Laszlo Ersek <lersek@redhat.com>
Date: Wed, 23 Nov 2016 06:27:09 +0100
Subject: [PATCH] efi/chainloader: truncate overlong relocation section
The UEFI Windows 7 boot loader ("EFI/Microsoft/Boot/bootmgfw.efi", SHA1
31b410e029bba87d2068c65a80b88882f9f8ea25) has inconsistent headers.
Compare:
> The Data Directory
> ...
> Entry 5 00000000000d9000 00000574 Base Relocation Directory [.reloc]
Versus:
> Sections:
> Idx Name Size VMA LMA File off ...
> ...
> 10 .reloc 00000e22 00000000100d9000 00000000100d9000 000a1800 ...
That is, the size reported by the RelocDir entry (0x574) is smaller than
the virtual size of the .reloc section (0xe22).
Quoting the grub2 debug log for the same:
> chainloader.c:595: reloc_dir: 0xd9000 reloc_size: 0x00000574
> chainloader.c:603: reloc_base: 0x7d208000 reloc_base_end: 0x7d208573
> ...
> chainloader.c:620: Section 10 ".reloc" at 0x7d208000..0x7d208e21
> chainloader.c:661: section is not reloc section?
> chainloader.c:663: rds: 0x00001000, vs: 00000e22
> chainloader.c:664: base: 0x7d208000 end: 0x7d208e21
> chainloader.c:666: reloc_base: 0x7d208000 reloc_base_end: 0x7d208573
> chainloader.c:671: Section characteristics are 42000040
> chainloader.c:673: Section virtual size: 00000e22
> chainloader.c:675: Section raw_data size: 00001000
> chainloader.c:678: Discarding section
After hexdumping "bootmgfw.efi" and manually walking its relocation blocks
(yes, really), I determined that the (smaller) RelocDir value is correct.
The remaining area that extends up to the .reloc section size (== 0xe22 -
0x574 == 0x8ae bytes) exists as zero padding in the file.
This zero padding shouldn't be passed to relocate_coff() for parsing. In
order to cope with it, split the handling of .reloc sections into the
following branches:
- original case (equal size): original behavior (--> relocation
attempted),
- overlong .reloc section (longer than reported by RelocDir): truncate the
section to the RelocDir size for the purposes of relocate_coff(), and
attempt relocation,
- .reloc section is too short, or other checks fail: original behavior
(--> relocation not attempted).
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1347291
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---
grub-core/loader/efi/chainloader.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
index ed8c364789a..db1ffeefc93 100644
--- a/grub-core/loader/efi/chainloader.c
+++ b/grub-core/loader/efi/chainloader.c
@@ -596,7 +596,7 @@ handle_image (void *data, grub_efi_uint32_t datasize)
grub_dprintf ("chain", "reloc_base: %p reloc_base_end: %p\n",
reloc_base, reloc_base_end);
- struct grub_pe32_section_table *reloc_section = NULL;
+ struct grub_pe32_section_table *reloc_section = NULL, fake_reloc_section;
section = context.first_section;
for (i = 0; i < context.number_of_sections; i++, section++)
@@ -645,12 +645,28 @@ handle_image (void *data, grub_efi_uint32_t datasize)
* made sense, and the VA and size match RelocDir's
* versions, then we believe in this section table. */
if (section->raw_data_size && section->virtual_size &&
- base && end && reloc_base == base && reloc_base_end == end)
+ base && end && reloc_base == base)
{
- grub_dprintf ("chain", " section is relocation section\n");
- reloc_section = section;
+ if (reloc_base_end == end)
+ {
+ grub_dprintf ("chain", " section is relocation section\n");
+ reloc_section = section;
+ }
+ else if (reloc_base_end && reloc_base_end < end)
+ {
+ /* Bogus virtual size in the reloc section -- RelocDir
+ * reported a smaller Base Relocation Directory. Decrease
+ * the section's virtual size so that it equal RelocDir's
+ * idea, but only for the purposes of relocate_coff(). */
+ grub_dprintf ("chain",
+ " section is (overlong) relocation section\n");
+ grub_memcpy (&fake_reloc_section, section, sizeof *section);
+ fake_reloc_section.virtual_size -= (end - reloc_base_end);
+ reloc_section = &fake_reloc_section;
+ }
}
- else
+
+ if (!reloc_section)
{
grub_dprintf ("chain", " section is not reloc section?\n");
grub_dprintf ("chain", " rds: 0x%08x, vs: %08x\n",