0101-video-readers-jpeg-Don-t-decode-data-before-start-of.patch 1.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940
  1. From 8338a8238f08d9f3ae4c2ddfff0603eff80af9e2 Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Fri, 15 Jan 2021 14:06:46 +1100
  4. Subject: [PATCH] video/readers/jpeg: Don't decode data before start of stream
  5. When a start of stream marker is encountered, we call grub_jpeg_decode_sos()
  6. which allocates space for a bitmap.
  7. When a restart marker is encountered, we call grub_jpeg_decode_data() which
  8. then fills in that bitmap.
  9. If we get a restart marker before the start of stream marker, we will
  10. attempt to write to a bitmap_ptr that hasn't been allocated. Catch this
  11. and bail out. This fixes an attempt to write to NULL.
  12. Signed-off-by: Daniel Axtens <dja@axtens.net>
  13. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  14. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  15. ---
  16. grub-core/video/readers/jpeg.c | 4 ++++
  17. 1 file changed, 4 insertions(+)
  18. diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
  19. index e514812..e31602f 100644
  20. --- a/grub-core/video/readers/jpeg.c
  21. +++ b/grub-core/video/readers/jpeg.c
  22. @@ -646,6 +646,10 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data)
  23. nr1 = (data->image_height + vb - 1) >> (3 + data->log_vs);
  24. nc1 = (data->image_width + hb - 1) >> (3 + data->log_hs);
  25. + if (data->bitmap_ptr == NULL)
  26. + return grub_error(GRUB_ERR_BAD_FILE_TYPE,
  27. + "jpeg: attempted to decode data before start of stream");
  28. +
  29. for (; data->r1 < nr1 && (!data->dri || rst);
  30. data->r1++, data->bitmap_ptr += (vb * data->image_width - hb * nc1) * 3)
  31. for (c1 = 0; c1 < nc1 && (!data->dri || rst);
  32. --
  33. 2.14.2