0100-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch 1.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748
  1. From 34b85a6e07014383ddcad09f99ff239ad752dd1a Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Fri, 15 Jan 2021 13:29:53 +1100
  4. Subject: [PATCH] video/readers/jpeg: Catch OOB reads/writes in
  5. grub_jpeg_decode_du()
  6. The key line is:
  7. du[jpeg_zigzag_order[pos]] = val * (int) data->quan_table[qt][pos];
  8. jpeg_zigzag_order is grub_uint8_t[64].
  9. I don't understand JPEG decoders quite well enough to explain what's
  10. going on here. However, I observe sometimes pos=64, which leads to an
  11. OOB read of the jpeg_zigzag_order global then an OOB write to du.
  12. That leads to various unpleasant memory corruption conditions.
  13. Catch where pos >= ARRAY_SIZE(jpeg_zigzag_order) and bail.
  14. Signed-off-by: Daniel Axtens <dja@axtens.net>
  15. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  16. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  17. ---
  18. grub-core/video/readers/jpeg.c | 8 ++++++++
  19. 1 file changed, 8 insertions(+)
  20. diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
  21. index 23f919a..e514812 100644
  22. --- a/grub-core/video/readers/jpeg.c
  23. +++ b/grub-core/video/readers/jpeg.c
  24. @@ -526,6 +526,14 @@ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du)
  25. val = grub_jpeg_get_number (data, num & 0xF);
  26. num >>= 4;
  27. pos += num;
  28. +
  29. + if (pos >= ARRAY_SIZE (jpeg_zigzag_order))
  30. + {
  31. + grub_error (GRUB_ERR_BAD_FILE_TYPE,
  32. + "jpeg: invalid position in zigzag order!?");
  33. + return;
  34. + }
  35. +
  36. du[jpeg_zigzag_order[pos]] = val * (int) data->quan_table[qt][pos];
  37. pos++;
  38. }
  39. --
  40. 2.14.2