0117-io-gzio-Zero-gzio-tl-td-in-init_dynamic_block-if-huf.patch 1.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142
  1. From b5a2b59cc5b8f5ee7ba3b951e7693e402d5b3a6f Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Thu, 21 Jan 2021 12:22:28 +1100
  4. Subject: [PATCH] io/gzio: Zero gzio->tl/td in init_dynamic_block() if
  5. huft_build() fails
  6. If huft_build() fails, gzio->tl or gzio->td could contain pointers that
  7. are no longer valid. Zero them out.
  8. This prevents a double free when grub_gzio_close() comes through and
  9. attempts to free them again.
  10. Signed-off-by: Daniel Axtens <dja@axtens.net>
  11. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  12. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  13. ---
  14. grub-core/io/gzio.c | 2 ++
  15. 1 file changed, 2 insertions(+)
  16. diff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c
  17. index 19adebe..aea86a0 100644
  18. --- a/grub-core/io/gzio.c
  19. +++ b/grub-core/io/gzio.c
  20. @@ -1010,6 +1010,7 @@ init_dynamic_block (grub_gzio_t gzio)
  21. gzio->bl = lbits;
  22. if (huft_build (ll, nl, 257, cplens, cplext, &gzio->tl, &gzio->bl) != 0)
  23. {
  24. + gzio->tl = 0;
  25. grub_error (GRUB_ERR_BAD_COMPRESSED_DATA,
  26. "failed in building a Huffman code table");
  27. return;
  28. @@ -1019,6 +1020,7 @@ init_dynamic_block (grub_gzio_t gzio)
  29. {
  30. huft_free (gzio->tl);
  31. gzio->tl = 0;
  32. + gzio->td = 0;
  33. grub_error (GRUB_ERR_BAD_COMPRESSED_DATA,
  34. "failed in building a Huffman code table");
  35. return;
  36. --
  37. 2.14.2