Red Hat Bugzilla – Bug 496093
[PATCH] Fix memory corruption in grub
Last modified: 2010-01-30 17:07:27 EST
Created attachment 339859 [details]
Fix for memory corruption
attached is a simple patch for a memory corruption in grub I discovered a while ago. This patch will make reliable booting from RAID1 discs possible again, atleast that's how I discovered the problem back then.
OMG! Unbelievable! :-( It's the
s1[n - 1] = 0;
in grub_strncat(..) that corrupts the memory whenever n is out of bounds. In the place you've found, n is 256 instead of the target array size 16, and in turn the memory is corrupted *always*. (The generated device id string itself is never longer than 16, though)
Thanks for this patch; it'll be in grub-0.97-51 .
grub-0.97-51.fc11 has been submitted as an update for Fedora 11.
grub-0.97-51.fc11 has been pushed to the Fedora 11 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update grub'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F11/FEDORA-2009-6351
grub-0.97-51.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.