0116-io-gzio-Catch-missing-values-in-huft_build-and-bail.patch 1.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
  1. From 4e76b08f7171a8603d74fcafb27409a91f578647 Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Thu, 21 Jan 2021 12:20:49 +1100
  4. Subject: [PATCH] io/gzio: Catch missing values in huft_build() and bail
  5. In huft_build(), "v" is a table of values in order of bit length.
  6. The code later (when setting up table entries in "r") assumes that all
  7. elements of this array corresponding to a code are initialized and less
  8. than N_MAX. However, it doesn't enforce this.
  9. With sufficiently manipulated inputs (e.g. from fuzzing), there can be
  10. elements of "v" that are not filled. Therefore a lookup into "e" or "d"
  11. will use an uninitialized value. This can lead to an invalid/OOB read on
  12. those values, often leading to a crash.
  13. Signed-off-by: Daniel Axtens <dja@axtens.net>
  14. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  15. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  16. ---
  17. grub-core/io/gzio.c | 10 +++++++++-
  18. 1 file changed, 9 insertions(+), 1 deletion(-)
  19. diff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c
  20. index 4236f0f..19adebe 100644
  21. --- a/grub-core/io/gzio.c
  22. +++ b/grub-core/io/gzio.c
  23. @@ -507,6 +507,7 @@ huft_build (unsigned *b, /* code lengths in bits (all assumed <= BMAX) */
  24. }
  25. /* Make a table of values in order of bit lengths */
  26. + grub_memset (v, N_MAX, ARRAY_SIZE (v));
  27. p = b;
  28. i = 0;
  29. do
  30. @@ -588,11 +589,18 @@ huft_build (unsigned *b, /* code lengths in bits (all assumed <= BMAX) */
  31. r.v.n = (ush) (*p); /* simple code is just the value */
  32. p++; /* one compiler does not like *p++ */
  33. }
  34. - else
  35. + else if (*p < N_MAX)
  36. {
  37. r.e = (uch) e[*p - s]; /* non-simple--look up in lists */
  38. r.v.n = d[*p++ - s];
  39. }
  40. + else
  41. + {
  42. + /* Detected an uninitialised value, abort. */
  43. + if (h)
  44. + huft_free (u[0]);
  45. + return 2;
  46. + }
  47. /* fill code-like entries with r */
  48. f = 1 << (k - w);
  49. --
  50. 2.14.2