|
 |
b1bcb2 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b1bcb2 |
From: Darren Kenny <darren.kenny@oracle.com>
|
|
|
b1bcb2 |
Date: Thu, 5 Nov 2020 10:57:14 +0000
|
|
|
b1bcb2 |
Subject: [PATCH] gnulib/regexec: Fix possible null-dereference
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
It appears to be possible that the mctx->state_log field may be NULL,
|
|
|
b1bcb2 |
and the name of this function, clean_state_log_if_needed(), suggests
|
|
|
b1bcb2 |
that it should be checking that it is valid to be cleaned before
|
|
|
b1bcb2 |
assuming that it does.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Fixes: CID 86720
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
|
|
|
b1bcb2 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b1bcb2 |
---
|
|
|
b1bcb2 |
grub-core/gnulib/regexec.c | 3 +++
|
|
|
b1bcb2 |
conf/Makefile.extra-dist | 1 +
|
|
|
b1bcb2 |
grub-core/gnulib-fix-regexec-null-deref.patch | 12 ++++++++++++
|
|
|
b1bcb2 |
3 files changed, 16 insertions(+)
|
|
|
b1bcb2 |
create mode 100644 grub-core/gnulib-fix-regexec-null-deref.patch
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
diff --git a/grub-core/gnulib/regexec.c b/grub-core/gnulib/regexec.c
|
|
|
b1bcb2 |
index fdc178e07a4..1e4cb2df4e3 100644
|
|
|
b1bcb2 |
--- a/grub-core/gnulib/regexec.c
|
|
|
b1bcb2 |
+++ b/grub-core/gnulib/regexec.c
|
|
|
b1bcb2 |
@@ -1754,6 +1754,9 @@ clean_state_log_if_needed (re_match_context_t *mctx, Idx next_state_log_idx)
|
|
|
b1bcb2 |
{
|
|
|
b1bcb2 |
Idx top = mctx->state_log_top;
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
+ if (mctx->state_log == NULL)
|
|
|
b1bcb2 |
+ return REG_NOERROR;
|
|
|
b1bcb2 |
+
|
|
|
b1bcb2 |
if ((next_state_log_idx >= mctx->input.bufs_len
|
|
|
b1bcb2 |
&& mctx->input.bufs_len < mctx->input.len)
|
|
|
b1bcb2 |
|| (next_state_log_idx >= mctx->input.valid_len
|
|
|
b1bcb2 |
diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist
|
|
|
b1bcb2 |
index c3506afe792..60d9f564236 100644
|
|
|
b1bcb2 |
--- a/conf/Makefile.extra-dist
|
|
|
b1bcb2 |
+++ b/conf/Makefile.extra-dist
|
|
|
b1bcb2 |
@@ -28,6 +28,7 @@ EXTRA_DIST += grub-core/genemuinitheader.sh
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
EXTRA_DIST += grub-core/gnulib-fix-null-deref.diff
|
|
|
b1bcb2 |
EXTRA_DIST += grub-core/gnulib-fix-null-state-deref.patch
|
|
|
b1bcb2 |
+EXTRA_DIST += grub-core/gnulib-fix-regexec-null-deref.patch
|
|
|
b1bcb2 |
EXTRA_DIST += grub-core/gnulib-fix-uninit-structure.patch
|
|
|
b1bcb2 |
EXTRA_DIST += grub-core/gnulib-fix-unused-value.patch
|
|
|
b1bcb2 |
EXTRA_DIST += grub-core/gnulib-fix-width.diff
|
|
|
b1bcb2 |
diff --git a/grub-core/gnulib-fix-regexec-null-deref.patch b/grub-core/gnulib-fix-regexec-null-deref.patch
|
|
|
b1bcb2 |
new file mode 100644
|
|
|
b1bcb2 |
index 00000000000..db6dac9c9e3
|
|
|
b1bcb2 |
--- /dev/null
|
|
|
b1bcb2 |
+++ b/grub-core/gnulib-fix-regexec-null-deref.patch
|
|
|
b1bcb2 |
@@ -0,0 +1,12 @@
|
|
|
b1bcb2 |
+--- a/lib/regexec.c 2020-10-21 14:25:35.310195912 +0000
|
|
|
b1bcb2 |
++++ b/lib/regexec.c 2020-11-05 10:55:09.621542984 +0000
|
|
|
b1bcb2 |
+@@ -1692,6 +1692,9 @@
|
|
|
b1bcb2 |
+ {
|
|
|
b1bcb2 |
+ Idx top = mctx->state_log_top;
|
|
|
b1bcb2 |
+
|
|
|
b1bcb2 |
++ if (mctx->state_log == NULL)
|
|
|
b1bcb2 |
++ return REG_NOERROR;
|
|
|
b1bcb2 |
++
|
|
|
b1bcb2 |
+ if ((next_state_log_idx >= mctx->input.bufs_len
|
|
|
b1bcb2 |
+ && mctx->input.bufs_len < mctx->input.len)
|
|
|
b1bcb2 |
+ || (next_state_log_idx >= mctx->input.valid_len
|