Home Search Pricing Get inErrata About

Sign in Sign up

Graph/grub2

Component

grub2

grub2

grub2

Node Details

Public graph metadata

Updated5/1/2026

Connections

18 linked nodes

WRITTEN_INLanguage

SUPPORTSLanguage

RELATES_TOComponent

AFFECTSRootCause

YY_FATAL_ERROR only prints a message instead of halting execution — in the configuration file parser's lexer. Tension: allowing flex-generated code to continue past safety checks. Outcome: when yyleng >= YYLMAX, the subsequent yy_flex_strncpy call overflows the yytext buffer because YY_FATAL_ERROR returned instead of exiting.

AFFECTSRootCause

grub_png_convert_image() advances destination pointer by 4 bytes per pixel for 16-bit gray images — the destination bitmap is allocated as RGB_888 (3 bytes/pixel). Tension: causing heap OOB write of width*height bytes past the bitmap buffer. Outcome: stride mismatch.

AFFECTSSolution

change line 940 from `d1 += 4` to `d1 += 3` — In grub_png_convert_image(). Tension: This matches the correct 3-bytes/pixel stride for the RGB_888 bitmap output buffer. Outcome: Also apply safe math to line 335: replace the unprotected integer multiplication with grub_mul().

AFFECTSRootCause

An integer overflow in the computation of max_glyph_size lets bounds.width * bounds.height wrap to a small allocation size.

AFFECTSSolution

Use safe overflow-checked arithmetic for the intermediate size calculation and reject unreasonable bounds values.

AFFECTSRootCause

when n > num_values, indices go negative — for (i=0; i<n; i++) ht->values[ht->num_values - i] = ht->values[ht->num_values - i - 1];. Outcome: fix adds n > ht->num_values check in grub_png_insert_huff_item at line 419-424.

AFFECTSRootCause

Outcome: grub_realloc() to allocate a buffer far too small for the actual data.

AFFECTSSolution

change `unsigned len` to `grub_size_t len` and `unsigned hint` parameter to `grub_size_t hint`. Tension: The bounds check should use: `if (parser->lexerstate->used + len < parser->lexerstate->used || parser->lexerstate->used + len >= parser->lexerstate->size)`. Outcome: The struct fields `used` and `size` in grub_lexer_param should be widened to `grub_size_t`.

AFFECTSRootCause

PNG format includes 1-byte filter at start of each scanline — grub-core/video/readers/png.c. Tension: buffer allocation doesn't account for these filter bytes. Outcome: The overflow occurs in grub_png_output_byte() at line 600 when writing past allocated heap.

PERTAIN_TOProblem

Heap buffer overflow in GRUB2's PNG image loader — when processing crafted 16-bit grayscale PNG images without alpha. Tension: grub_png_convert_image() advances destination pointer by 4 bytes per pixel for 16-bit gray images, but the destination bitmap is allocated as RGB_888 (3 bytes/pixel). Outcome: causing heap OOB write of width*height bytes past the bitmap buffer.

PERTAIN_TOProblem

heap buffer overflow in GRUB2's font rendering pipeline — when processing crafted PF2 font files. Outcome: enabling arbitrary code execution in the bootloader.

PERTAIN_TOSolution

fix adds n > ht->num_values check in grub_png_insert_huff_item at line 419-424 — grub_png_insert_huff_item at line 419-424. Outcome: commit 210245129 explicitly fixing CVE-2021-3696: 'video/readers/png: Avoid heap OOB R/W inserting huff table items'.

OCCURS_ONProblem

Heap buffer overflow in GRUB2's PNG image loader — when processing crafted 16-bit grayscale PNG images without alpha. Tension: grub_png_convert_image() advances destination pointer by 4 bytes per pixel for 16-bit gray images, but the destination bitmap is allocated as RGB_888 (3 bytes/pixel). Outcome: causing heap OOB write of width*height bytes past the bitmap buffer.

OCCURS_INProblem

When a GRUB script token exceeds YYLMAX size — in GRUB2 2.04 (and earlier). Tension: the lexer should terminate with a fatal error, but instead continues execution, allowing a buffer overflow in the yytext buffer. Outcome: This can lead to code execution and Secure Boot bypass.

OCCURS_INProblem

heap buffer overflow in GRUB2's font rendering pipeline — when processing crafted PF2 font files. Outcome: enabling arbitrary code execution in the bootloader.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata