dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0396-gnulib-regexec-Fix-possible-null-dereference.patch

468bd4
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
468bd4
From: Darren Kenny <darren.kenny@oracle.com>
468bd4
Date: Thu, 5 Nov 2020 10:57:14 +0000
468bd4
Subject: [PATCH] gnulib/regexec: Fix possible null-dereference
468bd4
468bd4
It appears to be possible that the mctx->state_log field may be NULL,
468bd4
and the name of this function, clean_state_log_if_needed(), suggests
468bd4
that it should be checking that it is valid to be cleaned before
468bd4
assuming that it does.
468bd4
468bd4
Fixes: CID 86720
468bd4
468bd4
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
468bd4
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
468bd4
---
468bd4
 grub-core/gnulib/regexec.c                    |  3 +++
468bd4
 conf/Makefile.extra-dist                      |  1 +
468bd4
 grub-core/gnulib-fix-regexec-null-deref.patch | 12 ++++++++++++
468bd4
 3 files changed, 16 insertions(+)
468bd4
 create mode 100644 grub-core/gnulib-fix-regexec-null-deref.patch
468bd4
468bd4
diff --git a/grub-core/gnulib/regexec.c b/grub-core/gnulib/regexec.c
468bd4
index 9264f262893..fdacff12ce3 100644
468bd4
--- a/grub-core/gnulib/regexec.c
468bd4
+++ b/grub-core/gnulib/regexec.c
468bd4
@@ -1754,6 +1754,9 @@ clean_state_log_if_needed (re_match_context_t *mctx, Idx next_state_log_idx)
468bd4
 {
468bd4
   Idx top = mctx->state_log_top;
468bd4
 
468bd4
+  if (mctx->state_log == NULL)
468bd4
+    return REG_NOERROR;
468bd4
+
468bd4
   if ((next_state_log_idx >= mctx->input.bufs_len
468bd4
        && mctx->input.bufs_len < mctx->input.len)
468bd4
       || (next_state_log_idx >= mctx->input.valid_len
468bd4
diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist
468bd4
index 06606de8d19..edbe7846eb1 100644
468bd4
--- a/conf/Makefile.extra-dist
468bd4
+++ b/conf/Makefile.extra-dist
468bd4
@@ -32,6 +32,7 @@ EXTRA_DIST += grub-core/genemuinitheader.sh
468bd4
 
468bd4
 EXTRA_DIST += grub-core/gnulib-fix-null-deref.diff
468bd4
 EXTRA_DIST += grub-core/gnulib-fix-null-state-deref.patch
468bd4
+EXTRA_DIST += grub-core/gnulib-fix-regexec-null-deref.patch
468bd4
 EXTRA_DIST += grub-core/gnulib-fix-uninit-structure.patch
468bd4
 EXTRA_DIST += grub-core/gnulib-fix-unused-value.patch
468bd4
 EXTRA_DIST += grub-core/gnulib-fix-width.diff
468bd4
diff --git a/grub-core/gnulib-fix-regexec-null-deref.patch b/grub-core/gnulib-fix-regexec-null-deref.patch
468bd4
new file mode 100644
468bd4
index 00000000000..db6dac9c9e3
468bd4
--- /dev/null
468bd4
+++ b/grub-core/gnulib-fix-regexec-null-deref.patch
468bd4
@@ -0,0 +1,12 @@
468bd4
+--- a/lib/regexec.c	2020-10-21 14:25:35.310195912 +0000
468bd4
++++ b/lib/regexec.c	2020-11-05 10:55:09.621542984 +0000
468bd4
+@@ -1692,6 +1692,9 @@
468bd4
+ {
468bd4
+   Idx top = mctx->state_log_top;
468bd4
+
468bd4
++  if (mctx->state_log == NULL)
468bd4
++    return REG_NOERROR;
468bd4
++
468bd4
+   if ((next_state_log_idx >= mctx->input.bufs_len
468bd4
+        && mctx->input.bufs_len < mctx->input.len)
468bd4
+       || (next_state_log_idx >= mctx->input.valid_len