Blame SOURCES/0227-efi-chainloader-fix-wrong-sanity-check-in-relocate_c.patch

a85e8e
From 57dd7429fb1a865f483723e865bd7e3729a299e4 Mon Sep 17 00:00:00 2001
a85e8e
From: Laszlo Ersek <lersek@redhat.com>
a85e8e
Date: Mon, 21 Nov 2016 15:34:00 +0100
a85e8e
Subject: [PATCH 227/260] efi/chainloader: fix wrong sanity check in
a85e8e
 relocate_coff()
a85e8e
a85e8e
In relocate_coff(), the relocation entries are parsed from the original
a85e8e
image (not the section-wise copied image). The original image is
a85e8e
pointed-to by the "orig" pointer. The current check
a85e8e
a85e8e
  (void *)reloc_end < data
a85e8e
a85e8e
compares the addresses of independent memory allocations. "data" is a typo
a85e8e
here, it should be "orig".
a85e8e
a85e8e
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1347291
a85e8e
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
a85e8e
Tested-by: Bogdan Costescu <bcostescu@gmail.com>
a85e8e
Tested-by: Juan Orti <j.orti.alcaine@gmail.com>
a85e8e
---
a85e8e
 grub-core/loader/efi/chainloader.c | 2 +-
a85e8e
 1 file changed, 1 insertion(+), 1 deletion(-)
a85e8e
a85e8e
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
a85e8e
index 3e89de900..ed8c36478 100644
a85e8e
--- a/grub-core/loader/efi/chainloader.c
a85e8e
+++ b/grub-core/loader/efi/chainloader.c
a85e8e
@@ -401,7 +401,7 @@ relocate_coff (pe_coff_loader_image_context_t *context,
a85e8e
       reloc_end = (struct grub_pe32_fixup_block *)
a85e8e
 	((char *)reloc_base + reloc_base->size);
a85e8e
 
a85e8e
-      if ((void *)reloc_end < data || (void *)reloc_end > image_end)
a85e8e
+      if ((void *)reloc_end < orig || (void *)reloc_end > image_end)
a85e8e
         {
a85e8e
           grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc entry %d overflows binary",
a85e8e
 		      n);
a85e8e
-- 
a85e8e
2.13.0
a85e8e