Blame SOURCES/0243-video-readers-png-Drop-greyscale-support-to-fix-heap.patch

1c6ba0
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
1c6ba0
From: Daniel Axtens <dja@axtens.net>
1c6ba0
Date: Tue, 6 Jul 2021 18:51:35 +1000
1c6ba0
Subject: [PATCH] video/readers/png: Drop greyscale support to fix heap
1c6ba0
 out-of-bounds write
1c6ba0
1c6ba0
A 16-bit greyscale PNG without alpha is processed in the following loop:
1c6ba0
1c6ba0
      for (i = 0; i < (data->image_width * data->image_height);
1c6ba0
	   i++, d1 += 4, d2 += 2)
1c6ba0
	{
1c6ba0
	  d1[R3] = d2[1];
1c6ba0
	  d1[G3] = d2[1];
1c6ba0
	  d1[B3] = d2[1];
1c6ba0
	}
1c6ba0
1c6ba0
The increment of d1 is wrong. d1 is incremented by 4 bytes per iteration,
1c6ba0
but there are only 3 bytes allocated for storage. This means that image
1c6ba0
data will overwrite somewhat-attacker-controlled parts of memory - 3 bytes
1c6ba0
out of every 4 following the end of the image.
1c6ba0
1c6ba0
This has existed since greyscale support was added in 2013 in commit
1c6ba0
3ccf16dff98f (grub-core/video/readers/png.c: Support grayscale).
1c6ba0
1c6ba0
Saving starfield.png as a 16-bit greyscale image without alpha in the gimp
1c6ba0
and attempting to load it causes grub-emu to crash - I don't think this code
1c6ba0
has ever worked.
1c6ba0
1c6ba0
Delete all PNG greyscale support.
1c6ba0
1c6ba0
Fixes: CVE-2021-3695
1c6ba0
1c6ba0
Signed-off-by: Daniel Axtens <dja@axtens.net>
1c6ba0
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
1c6ba0
(cherry picked from commit 0e1d163382669bd734439d8864ee969616d971d9)
1c6ba0
[rharwood: context conflict]
1c6ba0
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
1c6ba0
(cherry picked from commit 4c631c8119206b3178912df2905434d967661c3d)
1c6ba0
---
1c6ba0
 grub-core/video/readers/png.c | 85 +++----------------------------------------
1c6ba0
 1 file changed, 6 insertions(+), 79 deletions(-)
1c6ba0
1c6ba0
diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c
1c6ba0
index 8955b8ecfd..a3161e25b6 100644
1c6ba0
--- a/grub-core/video/readers/png.c
1c6ba0
+++ b/grub-core/video/readers/png.c
1c6ba0
@@ -100,7 +100,7 @@ struct grub_png_data
1c6ba0
 
1c6ba0
   unsigned image_width, image_height;
1c6ba0
   int bpp, is_16bit;
1c6ba0
-  int raw_bytes, is_gray, is_alpha, is_palette;
1c6ba0
+  int raw_bytes, is_alpha, is_palette;
1c6ba0
   int row_bytes, color_bits;
1c6ba0
   grub_uint8_t *image_data;
1c6ba0
 
1c6ba0
@@ -296,13 +296,13 @@ grub_png_decode_image_header (struct grub_png_data *data)
1c6ba0
     data->bpp = 3;
1c6ba0
   else
1c6ba0
     {
1c6ba0
-      data->is_gray = 1;
1c6ba0
-      data->bpp = 1;
1c6ba0
+      return grub_error (GRUB_ERR_BAD_FILE_TYPE,
1c6ba0
+			 "png: color type not supported");
1c6ba0
     }
1c6ba0
 
1c6ba0
   if ((color_bits != 8) && (color_bits != 16)
1c6ba0
       && (color_bits != 4
1c6ba0
-	  || !(data->is_gray || data->is_palette)))
1c6ba0
+	  || !data->is_palette))
1c6ba0
     return grub_error (GRUB_ERR_BAD_FILE_TYPE,
1c6ba0
                        "png: bit depth must be 8 or 16");
1c6ba0
 
1c6ba0
@@ -331,7 +331,7 @@ grub_png_decode_image_header (struct grub_png_data *data)
1c6ba0
     }
1c6ba0
 
1c6ba0
 #ifndef GRUB_CPU_WORDS_BIGENDIAN
1c6ba0
-  if (data->is_16bit || data->is_gray || data->is_palette)
1c6ba0
+  if (data->is_16bit || data->is_palette)
1c6ba0
 #endif
1c6ba0
     {
1c6ba0
       data->image_data = grub_calloc (data->image_height, data->row_bytes);
1c6ba0
@@ -899,27 +899,8 @@ grub_png_convert_image (struct grub_png_data *data)
1c6ba0
       int shift;
1c6ba0
       int mask = (1 << data->color_bits) - 1;
1c6ba0
       unsigned j;
1c6ba0
-      if (data->is_gray)
1c6ba0
-	{
1c6ba0
-	  /* Generic formula is
1c6ba0
-	     (0xff * i) / ((1U << data->color_bits) - 1)
1c6ba0
-	     but for allowed bit depth of 1, 2 and for it's
1c6ba0
-	     equivalent to
1c6ba0
-	     (0xff / ((1U << data->color_bits) - 1)) * i
1c6ba0
-	     Precompute the multipliers to avoid division.
1c6ba0
-	  */
1c6ba0
 
1c6ba0
-	  const grub_uint8_t multipliers[5] = { 0xff, 0xff, 0x55, 0x24, 0x11 };
1c6ba0
-	  for (i = 0; i < (1U << data->color_bits); i++)
1c6ba0
-	    {
1c6ba0
-	      grub_uint8_t col = multipliers[data->color_bits] * i;
1c6ba0
-	      palette[i][0] = col;
1c6ba0
-	      palette[i][1] = col;
1c6ba0
-	      palette[i][2] = col;
1c6ba0
-	    }
1c6ba0
-	}
1c6ba0
-      else
1c6ba0
-	grub_memcpy (palette, data->palette, 3 << data->color_bits);
1c6ba0
+      grub_memcpy (palette, data->palette, 3 << data->color_bits);
1c6ba0
       d1c = d1;
1c6ba0
       d2c = d2;
1c6ba0
       for (j = 0; j < data->image_height; j++, d1c += data->image_width * 3,
1c6ba0
@@ -956,60 +937,6 @@ grub_png_convert_image (struct grub_png_data *data)
1c6ba0
 	}
1c6ba0
       return;
1c6ba0
     }
1c6ba0
-  
1c6ba0
-  if (data->is_gray)
1c6ba0
-    {
1c6ba0
-      switch (data->bpp)
1c6ba0
-	{
1c6ba0
-	case 4:
1c6ba0
-	  /* 16-bit gray with alpha.  */
1c6ba0
-	  for (i = 0; i < (data->image_width * data->image_height);
1c6ba0
-	       i++, d1 += 4, d2 += 4)
1c6ba0
-	    {
1c6ba0
-	      d1[R4] = d2[3];
1c6ba0
-	      d1[G4] = d2[3];
1c6ba0
-	      d1[B4] = d2[3];
1c6ba0
-	      d1[A4] = d2[1];
1c6ba0
-	    }
1c6ba0
-	  break;
1c6ba0
-	case 2:
1c6ba0
-	  if (data->is_16bit)
1c6ba0
-	    /* 16-bit gray without alpha.  */
1c6ba0
-	    {
1c6ba0
-	      for (i = 0; i < (data->image_width * data->image_height);
1c6ba0
-		   i++, d1 += 4, d2 += 2)
1c6ba0
-		{
1c6ba0
-		  d1[R3] = d2[1];
1c6ba0
-		  d1[G3] = d2[1];
1c6ba0
-		  d1[B3] = d2[1];
1c6ba0
-		}
1c6ba0
-	    }
1c6ba0
-	  else
1c6ba0
-	    /* 8-bit gray with alpha.  */
1c6ba0
-	    {
1c6ba0
-	      for (i = 0; i < (data->image_width * data->image_height);
1c6ba0
-		   i++, d1 += 4, d2 += 2)
1c6ba0
-		{
1c6ba0
-		  d1[R4] = d2[1];
1c6ba0
-		  d1[G4] = d2[1];
1c6ba0
-		  d1[B4] = d2[1];
1c6ba0
-		  d1[A4] = d2[0];
1c6ba0
-		}
1c6ba0
-	    }
1c6ba0
-	  break;
1c6ba0
-	  /* 8-bit gray without alpha.  */
1c6ba0
-	case 1:
1c6ba0
-	  for (i = 0; i < (data->image_width * data->image_height);
1c6ba0
-	       i++, d1 += 3, d2++)
1c6ba0
-	    {
1c6ba0
-	      d1[R3] = d2[0];
1c6ba0
-	      d1[G3] = d2[0];
1c6ba0
-	      d1[B3] = d2[0];
1c6ba0
-	    }
1c6ba0
-	  break;
1c6ba0
-	}
1c6ba0
-      return;
1c6ba0
-    }
1c6ba0
 
1c6ba0
     {
1c6ba0
   /* Only copy the upper 8 bit.  */