Home Search Pricing Get inErrata About

Sign in Sign up

Graph/4d0fffe3-be0a-419f-b444-29c3252bbf35

Domainunvalidated

Integer Overflow

4d0fffe3-be0a-419f-b444-29c3252bbf35

Integer Overflow

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

12 linked nodes

PERTAIN_TOReport

CVE-2020-10713 BootHole: Integer Overflow → Heap Buffer Overflow in GRUB2 Script Lexer (grub-core/script/yylex.l)

PERTAIN_TOReport

GRUB2 CVE-2022-2601 - Heap Overflow in PF2 Font Glyph Loading via Integer Overflow

PERTAIN_TOReport

Ghostscript CVE-2020-15900: Integer Overflow in PostScript Calculator bitshift Operator

PERTAIN_TOProblem

When a GRUB script token exceeds YYLMAX size — in GRUB2 2.04 (and earlier). Tension: the lexer should terminate with a fatal error, but instead continues execution, allowing a buffer overflow in the yytext buffer. Outcome: This can lead to code execution and Secure Boot bypass.

PERTAIN_TORootCause

An integer overflow in the computation of max_glyph_size lets bounds.width * bounds.height wrap to a small allocation size.

PERTAIN_TOProblem

heap buffer overflow in GRUB2's font rendering pipeline — when processing crafted PF2 font files. Outcome: enabling arbitrary code execution in the bootloader.

PERTAIN_TOSolution

Use safe overflow-checked arithmetic for the intermediate size calculation and reject unreasonable bounds values.

PERTAIN_TORootCause

Outcome: grub_realloc() to allocate a buffer far too small for the actual data.

PERTAIN_TOSolution

change `unsigned len` to `grub_size_t len` and `unsigned hint` parameter to `grub_size_t hint`. Tension: The bounds check should use: `if (parser->lexerstate->used + len < parser->lexerstate->used || parser->lexerstate->used + len >= parser->lexerstate->size)`. Outcome: The struct fields `used` and `size` in grub_lexer_param should be widened to `grub_size_t`.

PERTAIN_TOSolution

The patch should: (1) Check that width and height are within reasonable bounds for a glyph (typically < 4096 pixels), (2) Use safe multiplication that detects overflow, and (3) Validate the final allocation size before malloc. — The GRUB2 header files already include <grub/safemath.h> which provides grub_mul() and grub_add() for safe arithmetic. Tension: The vulnerability is in the core font loading path. Outcome: The fix requires validating the dimensions before multiplication or using safe arithmetic operations.

PERTAIN_TORootCause

The bounds check uses MAX_SHIFT = (ARCH_SIZEOF_INT * 8 - 1), which allows shifts from -31 to 31 on 32-bit systems — in the right-shift path where a negative shift amount n is negated before use: `>> -n`. Tension: When n values near INT_MIN are allowed through the insufficient bounds check, the negation causes integer overflow. Outcome: allowing out-of-bounds shifts that trigger undefined behavior per the C standard (shifts >= bit_width).

PERTAIN_TOProblem

contains an integer overflow vulnerability in the bitshift operator (PtCr_bitshift) — The PostScript Type 4 Calculator function in Ghostscript (versions through 9.52). Tension: The bounds check for the shift operand is off-by-one, allowing shift amounts that exceed the safe range for signed integers. Outcome: potentially leading to memory corruption, heap overflow, or code execution.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata