0077-commands-hashsum-Fix-a-memory-leak.patch 1.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
  1. From 8b6f528e52e18b7a69f90b8dc3671d7b1147d9f3 Mon Sep 17 00:00:00 2001
  2. From: Chris Coulson <chris.coulson@canonical.com>
  3. Date: Tue, 1 Dec 2020 23:41:24 +0000
  4. Subject: [PATCH] commands/hashsum: Fix a memory leak
  5. check_list() uses grub_file_getline(), which allocates a buffer.
  6. If the hash list file contains invalid lines, the function leaks
  7. this buffer when it returns an error.
  8. Fixes: CID 176635
  9. Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
  10. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  11. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  12. ---
  13. grub-core/commands/hashsum.c | 15 ++++++++++++---
  14. 1 file changed, 12 insertions(+), 3 deletions(-)
  15. diff --git a/grub-core/commands/hashsum.c b/grub-core/commands/hashsum.c
  16. index 456ba90..b8a22b0 100644
  17. --- a/grub-core/commands/hashsum.c
  18. +++ b/grub-core/commands/hashsum.c
  19. @@ -128,11 +128,17 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename,
  20. high = hextoval (*p++);
  21. low = hextoval (*p++);
  22. if (high < 0 || low < 0)
  23. - return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
  24. + {
  25. + grub_free (buf);
  26. + return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
  27. + }
  28. expected[i] = (high << 4) | low;
  29. }
  30. if ((p[0] != ' ' && p[0] != '\t') || (p[1] != ' ' && p[1] != '\t'))
  31. - return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
  32. + {
  33. + grub_free (buf);
  34. + return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
  35. + }
  36. p += 2;
  37. if (prefix)
  38. {
  39. @@ -140,7 +146,10 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename,
  40. filename = grub_xasprintf ("%s/%s", prefix, p);
  41. if (!filename)
  42. - return grub_errno;
  43. + {
  44. + grub_free (buf);
  45. + return grub_errno;
  46. + }
  47. file = grub_file_open (filename, GRUB_FILE_TYPE_TO_HASH
  48. | (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS
  49. : GRUB_FILE_TYPE_NONE));
  50. --
  51. 2.14.2