Blame SOURCES/0436-video-readers-jpeg-Don-t-decode-data-before-start-of.patch

9723a8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
9723a8
From: Daniel Axtens <dja@axtens.net>
9723a8
Date: Fri, 15 Jan 2021 14:06:46 +1100
9723a8
Subject: [PATCH] video/readers/jpeg: Don't decode data before start of stream
9723a8
9723a8
When a start of stream marker is encountered, we call grub_jpeg_decode_sos()
9723a8
which allocates space for a bitmap.
9723a8
9723a8
When a restart marker is encountered, we call grub_jpeg_decode_data() which
9723a8
then fills in that bitmap.
9723a8
9723a8
If we get a restart marker before the start of stream marker, we will
9723a8
attempt to write to a bitmap_ptr that hasn't been allocated. Catch this
9723a8
and bail out. This fixes an attempt to write to NULL.
9723a8
9723a8
Signed-off-by: Daniel Axtens <dja@axtens.net>
9723a8
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
9723a8
---
9723a8
 grub-core/video/readers/jpeg.c | 4 ++++
9723a8
 1 file changed, 4 insertions(+)
9723a8
9723a8
diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
3efed6
index e5148120f69..e31602f766a 100644
9723a8
--- a/grub-core/video/readers/jpeg.c
9723a8
+++ b/grub-core/video/readers/jpeg.c
9723a8
@@ -646,6 +646,10 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data)
9723a8
   nr1 = (data->image_height + vb - 1) >> (3 + data->log_vs);
9723a8
   nc1 = (data->image_width + hb - 1)  >> (3 + data->log_hs);
9723a8
 
9723a8
+  if (data->bitmap_ptr == NULL)
9723a8
+    return grub_error(GRUB_ERR_BAD_FILE_TYPE,
9723a8
+		      "jpeg: attempted to decode data before start of stream");
9723a8
+
9723a8
   for (; data->r1 < nr1 && (!data->dri || rst);
9723a8
        data->r1++, data->bitmap_ptr += (vb * data->image_width - hb * nc1) * 3)
9723a8
     for (c1 = 0;  c1 < nc1 && (!data->dri || rst);