From: Alec Brown <alec.r.br...@oracle.com>

The Coverity indicates that the variable current_entry might overflow.
To prevent this use safe math when adding GRUB_MENU_PAGE_SIZE to current_entry.

On the occasion fix limiting condition which was broken.

Fixes: CID 473853

Signed-off-by: Alec Brown <alec.r.br...@oracle.com>
Reviewed-by: Daniel Kiper <daniel.ki...@oracle.com>
---
 grub-core/normal/menu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
index f24544b27..b946c834d 100644
--- a/grub-core/normal/menu.c
+++ b/grub-core/normal/menu.c
@@ -32,6 +32,7 @@
 #include <grub/script_sh.h>
 #include <grub/gfxterm.h>
 #include <grub/dl.h>
+#include <grub/safemath.h>
 
 /* Time to delay after displaying an error message about a default/fallback
    entry failing to boot.  */
@@ -751,9 +752,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int 
*notify_boot)
 
            case GRUB_TERM_CTRL | 'c':
            case GRUB_TERM_KEY_NPAGE:
-             if (current_entry + GRUB_MENU_PAGE_SIZE < menu->size)
-               current_entry += GRUB_MENU_PAGE_SIZE;
-             else
+             if (grub_add (current_entry, GRUB_MENU_PAGE_SIZE, &current_entry) 
|| current_entry >= menu->size)
                current_entry = menu->size - 1;
              menu_set_chosen_entry (current_entry);
              break;
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Reply via email to