CVE-2020-14310

There is an issue on grub2 before version 2.06 at function
read_section_as_string(). It expects a font name to be at max UINT32_MAX -
1 length in bytes but it doesn’t verify it before proceed with buffer
allocation to read the value from the font value. An attacker may leverage
that by crafting a malicious font file which has a name with UINT32_MAX,
leading to read_section_as_string() to an arithmetic overflow, zero-sized
allocation and further heap-based buffer overflow.

Notes