dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0451-io-gzio-Catch-missing-values-in-huft_build-and-bail.patch

468bd4
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
468bd4
From: Daniel Axtens <dja@axtens.net>
468bd4
Date: Thu, 21 Jan 2021 12:20:49 +1100
468bd4
Subject: [PATCH] io/gzio: Catch missing values in huft_build() and bail
468bd4
468bd4
In huft_build(), "v" is a table of values in order of bit length.
468bd4
The code later (when setting up table entries in "r") assumes that all
468bd4
elements of this array corresponding to a code are initialized and less
468bd4
than N_MAX. However, it doesn't enforce this.
468bd4
468bd4
With sufficiently manipulated inputs (e.g. from fuzzing), there can be
468bd4
elements of "v" that are not filled. Therefore a lookup into "e" or "d"
468bd4
will use an uninitialized value. This can lead to an invalid/OOB read on
468bd4
those values, often leading to a crash.
468bd4
468bd4
Signed-off-by: Daniel Axtens <dja@axtens.net>
468bd4
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
468bd4
---
468bd4
 grub-core/io/gzio.c | 10 +++++++++-
468bd4
 1 file changed, 9 insertions(+), 1 deletion(-)
468bd4
468bd4
diff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c
468bd4
index 97b34f88574..f85dbae237d 100644
468bd4
--- a/grub-core/io/gzio.c
468bd4
+++ b/grub-core/io/gzio.c
468bd4
@@ -507,6 +507,7 @@ huft_build (unsigned *b,	/* code lengths in bits (all assumed <= BMAX) */
468bd4
     }
468bd4
 
468bd4
   /* Make a table of values in order of bit lengths */
468bd4
+  grub_memset (v, N_MAX, ARRAY_SIZE (v));
468bd4
   p = b;
468bd4
   i = 0;
468bd4
   do
468bd4
@@ -588,11 +589,18 @@ huft_build (unsigned *b,	/* code lengths in bits (all assumed <= BMAX) */
468bd4
 	      r.v.n = (ush) (*p);	/* simple code is just the value */
468bd4
 	      p++;		/* one compiler does not like *p++ */
468bd4
 	    }
468bd4
-	  else
468bd4
+	  else if (*p < N_MAX)
468bd4
 	    {
468bd4
 	      r.e = (uch) e[*p - s];	/* non-simple--look up in lists */
468bd4
 	      r.v.n = d[*p++ - s];
468bd4
 	    }
468bd4
+	  else
468bd4
+	    {
468bd4
+	      /* Detected an uninitialised value, abort. */
468bd4
+	      if (h)
468bd4
+		huft_free (u[0]);
468bd4
+	      return 2;
468bd4
+	    }
468bd4
 
468bd4
 	  /* fill code-like entries with r */
468bd4
 	  f = 1 << (k - w);