use proper vararg processing to avoid segfaults on hardened systems #279536

1 files changed, 92 insertions, 0 deletions

diff --git a/src/patchsets/grub/0.97/011_all_grub-0.97-varargs.patch b/src/patchsets/grub/0.97/011_all_grub-0.97-varargs.patch
new file mode 100644
index 0000000000..1894ff1517
--- /dev/null
+++ b/src/patchsets/grub/0.97/011_all_grub-0.97-varargs.patch
@@ -0,0 +1,92 @@
+https://bugs.gentoo.org/279536
+
+use proper vararg functions instead of trying to walk the stack ourselves
+
+patch by Anthony Basile <basile@opensource.dyc.edu>
+
+--- grub-0.97/stage2/char_io.c
++++ grub-0.97/stage2/char_io.c
+@@ -20,6 +20,7 @@
+ 
+ #include <shared.h>
+ #include <term.h>
++#include <stdarg.h>
+ 
+ #ifdef SUPPORT_HERCULES
+ # include <hercules.h>
+@@ -178,10 +179,11 @@
+ void
+ grub_printf (const char *format,...)
+ {
+-  int *dataptr = (int *) &format;
++  va_list ap ;
++  va_start(ap, format);
++
+   char c, str[16];
+   
+-  dataptr++;
+ 
+   while ((c = *(format++)) != 0)
+     {
+@@ -196,17 +198,17 @@
+ 	  case 'X':
+ #endif
+ 	  case 'u':
+-	    *convert_to_ascii (str, c, *((unsigned long *) dataptr++)) = 0;
++	    *convert_to_ascii (str, c, va_arg(ap, unsigned long)) = 0;
+ 	    grub_putstr (str);
+ 	    break;
+ 
+ #ifndef STAGE1_5
+ 	  case 'c':
+-	    grub_putchar ((*(dataptr++)) & 0xff);
++	    grub_putchar (va_arg(ap, char) & 0xff);
+ 	    break;
+ 
+ 	  case 's':
+-	    grub_putstr ((char *) *(dataptr++));
++	    grub_putstr (va_arg(ap, char *));
+ 	    break;
+ #endif
+ 	  }
+@@ -219,12 +221,12 @@
+ {
+   /* XXX hohmuth
+      ugly hack -- should unify with printf() */
+-  int *dataptr = (int *) &format;
++  va_list ap ;
++  va_start(ap, format);
++
+   char c, *ptr, str[16];
+   char *bp = buffer;
+ 
+-  dataptr++;
+-
+   while ((c = *format++) != 0)
+     {
+       if (c != '%')
+@@ -233,7 +235,7 @@
+ 	switch (c = *(format++))
+ 	  {
+ 	  case 'd': case 'u': case 'x':
+-	    *convert_to_ascii (str, c, *((unsigned long *) dataptr++)) = 0;
++	    *convert_to_ascii (str, c, va_arg(ap, unsigned long)) = 0;
+ 
+ 	    ptr = str;
+ 
+@@ -241,12 +243,12 @@
+ 	      *bp++ = *(ptr++); /* putchar(*(ptr++)); */
+ 	    break;
+ 
+-	  case 'c': *bp++ = (*(dataptr++))&0xff;
+-	    /* putchar((*(dataptr++))&0xff); */
++	  case 'c': *bp++ = va_arg(ap, char) & 0xff;
++	    /* putchar (va_arg(ap, char) & 0xff); */
+ 	    break;
+ 
+ 	  case 's':
+-	    ptr = (char *) (*(dataptr++));
++	    ptr = va_arg(ap, char *);
+ 
+ 	    while ((c = *ptr++) != 0)
+ 	      *bp++ = c; /* putchar(c); */