0074-libgcrypt-mpi-Fix-possible-NULL-dereference.patch 1.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849
  1. From ae0f3fabeba7b393113d5dc185b6aff9b728136d Mon Sep 17 00:00:00 2001
  2. From: Darren Kenny <darren.kenny@oracle.com>
  3. Date: Thu, 26 Nov 2020 10:41:54 +0000
  4. Subject: [PATCH] libgcrypt/mpi: Fix possible NULL dereference
  5. The code in gcry_mpi_scan() assumes that buffer is not NULL, but there
  6. is no explicit check for that, so we add one.
  7. Fixes: CID 73757
  8. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  9. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  10. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  11. ---
  12. grub-core/lib/libgcrypt-grub/mpi/mpicoder.c | 3 +++
  13. grub-core/lib/libgcrypt/mpi/mpicoder.c | 3 +++
  14. 2 files changed, 6 insertions(+)
  15. diff --git a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c
  16. index faf1cd6..e734dcf 100644
  17. --- a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c
  18. +++ b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c
  19. @@ -381,6 +381,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format,
  20. unsigned int len;
  21. int secure = (buffer && gcry_is_secure (buffer));
  22. + if (!buffer)
  23. + return gcry_error (GPG_ERR_INV_ARG);
  24. +
  25. if (format == GCRYMPI_FMT_SSH)
  26. len = 0;
  27. else
  28. diff --git a/grub-core/lib/libgcrypt/mpi/mpicoder.c b/grub-core/lib/libgcrypt/mpi/mpicoder.c
  29. index 7ecad27..6fe3891 100644
  30. --- a/grub-core/lib/libgcrypt/mpi/mpicoder.c
  31. +++ b/grub-core/lib/libgcrypt/mpi/mpicoder.c
  32. @@ -379,6 +379,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format,
  33. unsigned int len;
  34. int secure = (buffer && gcry_is_secure (buffer));
  35. + if (!buffer)
  36. + return gcry_error (GPG_ERR_INV_ARG);
  37. +
  38. if (format == GCRYMPI_FMT_SSH)
  39. len = 0;
  40. else
  41. --
  42. 2.14.2