dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone
b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Chris Coulson <chris.coulson@canonical.com>
b1bcb2
Date: Tue, 1 Dec 2020 23:41:24 +0000
b1bcb2
Subject: [PATCH] commands/hashsum: Fix a memory leak
b1bcb2
b1bcb2
check_list() uses grub_file_getline(), which allocates a buffer.
b1bcb2
If the hash list file contains invalid lines, the function leaks
b1bcb2
this buffer when it returns an error.
b1bcb2
b1bcb2
Fixes: CID 176635
b1bcb2
b1bcb2
Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/commands/hashsum.c | 15 ++++++++++++---
b1bcb2
 1 file changed, 12 insertions(+), 3 deletions(-)
b1bcb2
b1bcb2
diff --git a/grub-core/commands/hashsum.c b/grub-core/commands/hashsum.c
b1bcb2
index d18687351a5..282922bba1e 100644
b1bcb2
--- a/grub-core/commands/hashsum.c
b1bcb2
+++ b/grub-core/commands/hashsum.c
b1bcb2
@@ -128,11 +128,17 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename,
b1bcb2
 	  high = hextoval (*p++);
b1bcb2
 	  low = hextoval (*p++);
b1bcb2
 	  if (high < 0 || low < 0)
b1bcb2
-	    return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
b1bcb2
+	    {
b1bcb2
+	      grub_free (buf);
b1bcb2
+	      return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
b1bcb2
+	    }
b1bcb2
 	  expected[i] = (high << 4) | low;
b1bcb2
 	}
b1bcb2
       if ((p[0] != ' ' && p[0] != '\t') || (p[1] != ' ' && p[1] != '\t'))
b1bcb2
-	return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
b1bcb2
+	{
b1bcb2
+	  grub_free (buf);
b1bcb2
+	  return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
b1bcb2
+	}
b1bcb2
       p += 2;
b1bcb2
       if (prefix)
b1bcb2
 	{
b1bcb2
@@ -140,7 +146,10 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename,
b1bcb2
 	  
b1bcb2
 	  filename = grub_xasprintf ("%s/%s", prefix, p);
b1bcb2
 	  if (!filename)
b1bcb2
-	    return grub_errno;
b1bcb2
+            {
b1bcb2
+              grub_free (buf);
b1bcb2
+              return grub_errno;
b1bcb2
+            }
b1bcb2
 	  if (!uncompress)
b1bcb2
 	    grub_file_filter_disable_compression ();
b1bcb2
 	  file = grub_file_open (filename);