dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0434-video-readers-jpeg-Catch-files-with-unsupported-quan.patch

9723a8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
9723a8
From: Daniel Axtens <dja@axtens.net>
9723a8
Date: Fri, 15 Jan 2021 12:57:04 +1100
9723a8
Subject: [PATCH] video/readers/jpeg: Catch files with unsupported quantization
9723a8
 or Huffman tables
9723a8
9723a8
Our decoder only supports 2 quantization tables. If a file asks for
9723a8
a quantization table with index > 1, reject it.
9723a8
9723a8
Similarly, our decoder only supports 4 Huffman tables. If a file asks
9723a8
for a Huffman table with index > 3, reject it.
9723a8
9723a8
This fixes some out of bounds reads. It's not clear what degree of control
9723a8
over subsequent execution could be gained by someone who can carefully
9723a8
set up the contents of memory before loading an invalid JPEG file.
9723a8
9723a8
Signed-off-by: Daniel Axtens <dja@axtens.net>
9723a8
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
9723a8
---
9723a8
 grub-core/video/readers/jpeg.c | 8 ++++++++
9723a8
 1 file changed, 8 insertions(+)
9723a8
9723a8
diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
3efed6
index 0b6ce3cee64..23f919aa070 100644
9723a8
--- a/grub-core/video/readers/jpeg.c
9723a8
+++ b/grub-core/video/readers/jpeg.c
9723a8
@@ -333,7 +333,11 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
9723a8
       else if (ss != JPEG_SAMPLING_1x1)
9723a8
 	return grub_error (GRUB_ERR_BAD_FILE_TYPE,
9723a8
 			   "jpeg: sampling method not supported");
9723a8
+
9723a8
       data->comp_index[id][0] = grub_jpeg_get_byte (data);
9723a8
+      if (data->comp_index[id][0] > 1)
9723a8
+	return grub_error (GRUB_ERR_BAD_FILE_TYPE,
9723a8
+			   "jpeg: too many quantization tables");
9723a8
     }
9723a8
 
9723a8
   if (data->file->offset != next_marker)
9723a8
@@ -602,6 +606,10 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data)
9723a8
       ht = grub_jpeg_get_byte (data);
9723a8
       data->comp_index[id][1] = (ht >> 4);
9723a8
       data->comp_index[id][2] = (ht & 0xF) + 2;
9723a8
+
9723a8
+      if ((data->comp_index[id][1] < 0) || (data->comp_index[id][1] > 3) ||
9723a8
+	  (data->comp_index[id][2] < 0) || (data->comp_index[id][2] > 3))
9723a8
+	return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid hufftable index");
9723a8
     }
9723a8
 
9723a8
   grub_jpeg_get_byte (data);	/* Skip 3 unused bytes.  */