|
 |
468bd4 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
468bd4 |
From: Daniel Axtens <dja@axtens.net>
|
|
|
468bd4 |
Date: Thu, 21 Jan 2021 12:20:49 +1100
|
|
|
468bd4 |
Subject: [PATCH] io/gzio: Catch missing values in huft_build() and bail
|
|
|
468bd4 |
|
|
|
468bd4 |
In huft_build(), "v" is a table of values in order of bit length.
|
|
|
468bd4 |
The code later (when setting up table entries in "r") assumes that all
|
|
|
468bd4 |
elements of this array corresponding to a code are initialized and less
|
|
|
468bd4 |
than N_MAX. However, it doesn't enforce this.
|
|
|
468bd4 |
|
|
|
468bd4 |
With sufficiently manipulated inputs (e.g. from fuzzing), there can be
|
|
|
468bd4 |
elements of "v" that are not filled. Therefore a lookup into "e" or "d"
|
|
|
468bd4 |
will use an uninitialized value. This can lead to an invalid/OOB read on
|
|
|
468bd4 |
those values, often leading to a crash.
|
|
|
468bd4 |
|
|
|
468bd4 |
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
|
468bd4 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
468bd4 |
---
|
|
|
468bd4 |
grub-core/io/gzio.c | 10 +++++++++-
|
|
|
468bd4 |
1 file changed, 9 insertions(+), 1 deletion(-)
|
|
|
468bd4 |
|
|
|
468bd4 |
diff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c
|
|
|
468bd4 |
index 97b34f88574..f85dbae237d 100644
|
|
|
468bd4 |
--- a/grub-core/io/gzio.c
|
|
|
468bd4 |
+++ b/grub-core/io/gzio.c
|
|
|
468bd4 |
@@ -507,6 +507,7 @@ huft_build (unsigned *b, /* code lengths in bits (all assumed <= BMAX) */
|
|
|
468bd4 |
}
|
|
|
468bd4 |
|
|
|
468bd4 |
/* Make a table of values in order of bit lengths */
|
|
|
468bd4 |
+ grub_memset (v, N_MAX, ARRAY_SIZE (v));
|
|
|
468bd4 |
p = b;
|
|
|
468bd4 |
i = 0;
|
|
|
468bd4 |
do
|
|
|
468bd4 |
@@ -588,11 +589,18 @@ huft_build (unsigned *b, /* code lengths in bits (all assumed <= BMAX) */
|
|
|
468bd4 |
r.v.n = (ush) (*p); /* simple code is just the value */
|
|
|
468bd4 |
p++; /* one compiler does not like *p++ */
|
|
|
468bd4 |
}
|
|
|
468bd4 |
- else
|
|
|
468bd4 |
+ else if (*p < N_MAX)
|
|
|
468bd4 |
{
|
|
|
468bd4 |
r.e = (uch) e[*p - s]; /* non-simple--look up in lists */
|
|
|
468bd4 |
r.v.n = d[*p++ - s];
|
|
|
468bd4 |
}
|
|
|
468bd4 |
+ else
|
|
|
468bd4 |
+ {
|
|
|
468bd4 |
+ /* Detected an uninitialised value, abort. */
|
|
|
468bd4 |
+ if (h)
|
|
|
468bd4 |
+ huft_free (u[0]);
|
|
|
468bd4 |
+ return 2;
|
|
|
468bd4 |
+ }
|
|
|
468bd4 |
|
|
|
468bd4 |
/* fill code-like entries with r */
|
|
|
468bd4 |
f = 1 << (k - w);
|