Blame SOURCES/0249-misc-fix-invalid-character-recongition-in-strto-l.patch

a85e8e
From 86004f0ab4bfcbc578274fc153da1280a3ac04e6 Mon Sep 17 00:00:00 2001
a85e8e
From: Aaron Miller <aaronmiller@fb.com>
a85e8e
Date: Fri, 29 Jul 2016 17:41:27 +0800
a85e8e
Subject: [PATCH 249/260] misc: fix invalid character recongition in strto*l
a85e8e
a85e8e
Would previously allow digits larger than the base and didn't check that
a85e8e
subtracting the difference from 0-9 to lowercase letters for characters
a85e8e
larger than 9 didn't result in a value lower than 9, which allowed the
a85e8e
parses: ` = 9, _ = 8, ^ = 7, ] = 6, \ = 5, and [ = 4
a85e8e
---
a85e8e
 grub-core/kern/misc.c | 6 +++++-
a85e8e
 1 file changed, 5 insertions(+), 1 deletion(-)
a85e8e
a85e8e
diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c
a85e8e
index 240396c55..d0ca2ee60 100644
a85e8e
--- a/grub-core/kern/misc.c
a85e8e
+++ b/grub-core/kern/misc.c
a85e8e
@@ -436,9 +436,13 @@ grub_strtoull (const char *str, char **end, int base)
a85e8e
       if (digit > 9)
a85e8e
 	{
a85e8e
 	  digit += '0' - 'a' + 10;
a85e8e
-	  if (digit >= (unsigned long) base)
a85e8e
+	  /* digit <= 9 check is needed to keep chars larger than
a85e8e
+	     '9' but less than 'a' from being read as numbers */
a85e8e
+	  if (digit >= (unsigned long) base || digit <= 9)
a85e8e
 	    break;
a85e8e
 	}
a85e8e
+      if (digit >= (unsigned long) base)
a85e8e
+	break;
a85e8e
 
a85e8e
       found = 1;
a85e8e
 
a85e8e
-- 
a85e8e
2.13.0
a85e8e