Skip to content
Snippets Groups Projects
  • Zhang Boyang's avatar
    2f01e9c0
    font: Fix size overflow in grub_font_get_glyph_internal() · 2f01e9c0
    Zhang Boyang authored
    
    The length of memory allocation and file read may overflow. This patch
    fixes the problem by using safemath macros.
    
    There is a lot of code repetition like "(x * y + 7) / 8". It is unsafe
    if overflow happens. This patch introduces grub_video_bitmap_calc_1bpp_bufsz().
    It is safe replacement for such code. It has safemath-like prototype.
    
    This patch also introduces grub_cast(value, pointer), it casts value to
    typeof(*pointer) then store the value to *pointer. It returns true when
    overflow occurs or false if there is no overflow. The semantics of arguments
    and return value are designed to be consistent with other safemath macros.
    
    Signed-off-by: default avatarZhang Boyang <zhangboyang.id@gmail.com>
    Reviewed-by: default avatarDaniel Kiper <daniel.kiper@oracle.com>
    2f01e9c0
    History
    font: Fix size overflow in grub_font_get_glyph_internal()
    Zhang Boyang authored
    
    The length of memory allocation and file read may overflow. This patch
    fixes the problem by using safemath macros.
    
    There is a lot of code repetition like "(x * y + 7) / 8". It is unsafe
    if overflow happens. This patch introduces grub_video_bitmap_calc_1bpp_bufsz().
    It is safe replacement for such code. It has safemath-like prototype.
    
    This patch also introduces grub_cast(value, pointer), it casts value to
    typeof(*pointer) then store the value to *pointer. It returns true when
    overflow occurs or false if there is no overflow. The semantics of arguments
    and return value are designed to be consistent with other safemath macros.
    
    Signed-off-by: default avatarZhang Boyang <zhangboyang.id@gmail.com>
    Reviewed-by: default avatarDaniel Kiper <daniel.kiper@oracle.com>