|
 |
d9d99f |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
d9d99f |
From: Aaron Miller <aaronmiller@fb.com>
|
|
|
d9d99f |
Date: Fri, 29 Jul 2016 17:41:27 +0800
|
|
|
d9d99f |
Subject: [PATCH] misc: fix invalid character recongition in strto*l
|
|
|
d9d99f |
|
|
|
d9d99f |
Would previously allow digits larger than the base and didn't check that
|
|
|
d9d99f |
subtracting the difference from 0-9 to lowercase letters for characters
|
|
|
d9d99f |
larger than 9 didn't result in a value lower than 9, which allowed the
|
|
|
d9d99f |
parses: ` = 9, _ = 8, ^ = 7, ] = 6, \ = 5, and [ = 4
|
|
|
d9d99f |
---
|
|
|
d9d99f |
grub-core/kern/misc.c | 13 ++++++++-----
|
|
|
d9d99f |
1 file changed, 8 insertions(+), 5 deletions(-)
|
|
|
d9d99f |
|
|
|
d9d99f |
diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c
|
|
|
b71686 |
index 0e89c483d..5c3899f0e 100644
|
|
|
d9d99f |
--- a/grub-core/kern/misc.c
|
|
|
d9d99f |
+++ b/grub-core/kern/misc.c
|
|
|
d9d99f |
@@ -434,11 +434,14 @@ grub_strtoull (const char *str, char **end, int base)
|
|
|
d9d99f |
unsigned long digit;
|
|
|
d9d99f |
|
|
|
d9d99f |
digit = grub_tolower (*str) - '0';
|
|
|
d9d99f |
- if (digit >= 'a' - '0')
|
|
|
d9d99f |
- digit += '0' - 'a' + 10;
|
|
|
d9d99f |
- else if (digit > 9)
|
|
|
d9d99f |
- break;
|
|
|
d9d99f |
-
|
|
|
d9d99f |
+ if (digit > 9)
|
|
|
d9d99f |
+ {
|
|
|
d9d99f |
+ digit += '0' - 'a' + 10;
|
|
|
d9d99f |
+ /* digit <= 9 check is needed to keep chars larger than
|
|
|
d9d99f |
+ '9' but less than 'a' from being read as numbers */
|
|
|
d9d99f |
+ if (digit >= (unsigned long) base || digit <= 9)
|
|
|
d9d99f |
+ break;
|
|
|
d9d99f |
+ }
|
|
|
d9d99f |
if (digit >= (unsigned long) base)
|
|
|
d9d99f |
break;
|
|
|
d9d99f |
|