0011-lzma-Make-sure-we-don-t-dereference-past-array.patch 2.1 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. From 78829f0c230680e386fff9f420bb1631bc20f761 Mon Sep 17 00:00:00 2001
  2. From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
  3. Date: Thu, 9 Jul 2020 03:05:23 +0000
  4. Subject: [PATCH] lzma: Make sure we don't dereference past array
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. The two dimensional array p->posSlotEncoder[4][64] is being dereferenced
  9. using the GetLenToPosState() macro which checks if len is less than 5,
  10. and if so subtracts 2 from it. If len = 0, that is 0 - 2 = 4294967294.
  11. Obviously we don't want to dereference that far out so we check if the
  12. position found is greater or equal kNumLenToPosStates (4) and bail out.
  13. N.B.: Upstream LZMA 18.05 and later has this function completely rewritten
  14. without any history.
  15. Fixes: CID 51526
  16. Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
  17. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  18. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  19. ---
  20. grub-core/lib/LzmaEnc.c | 10 ++++++++--
  21. 1 file changed, 8 insertions(+), 2 deletions(-)
  22. diff --git a/grub-core/lib/LzmaEnc.c b/grub-core/lib/LzmaEnc.c
  23. index f2ec04a8c..753e56a95 100644
  24. --- a/grub-core/lib/LzmaEnc.c
  25. +++ b/grub-core/lib/LzmaEnc.c
  26. @@ -1877,13 +1877,19 @@ static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize
  27. }
  28. else
  29. {
  30. - UInt32 posSlot;
  31. + UInt32 posSlot, lenToPosState;
  32. RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
  33. p->state = kMatchNextStates[p->state];
  34. LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
  35. pos -= LZMA_NUM_REPS;
  36. GetPosSlot(pos, posSlot);
  37. - RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot);
  38. + lenToPosState = GetLenToPosState(len);
  39. + if (lenToPosState >= kNumLenToPosStates)
  40. + {
  41. + p->result = SZ_ERROR_DATA;
  42. + return CheckErrors(p);
  43. + }
  44. + RcTree_Encode(&p->rc, p->posSlotEncoder[lenToPosState], kNumPosSlotBits, posSlot);
  45. if (posSlot >= kStartPosModelIndex)
  46. {
  47. --
  48. 2.26.2