|
 |
5975ab |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
a4d572 |
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
|
|
|
a4d572 |
Date: Thu, 9 Jul 2020 03:05:23 +0000
|
|
|
5975ab |
Subject: [PATCH] lzma: Make sure we don't dereference past array
|
|
|
a4d572 |
|
|
|
a4d572 |
The two dimensional array p->posSlotEncoder[4][64] is being dereferenced
|
|
|
a4d572 |
using the GetLenToPosState() macro which checks if len is less than 5,
|
|
|
a4d572 |
and if so subtracts 2 from it. If len = 0, that is 0 - 2 = 4294967294.
|
|
|
a4d572 |
Obviously we don't want to dereference that far out so we check if the
|
|
|
a4d572 |
position found is greater or equal kNumLenToPosStates (4) and bail out.
|
|
|
a4d572 |
|
|
|
a4d572 |
N.B.: Upstream LZMA 18.05 and later has this function completely rewritten
|
|
|
a4d572 |
without any history.
|
|
|
a4d572 |
|
|
|
a4d572 |
Fixes: CID 51526
|
|
|
a4d572 |
|
|
|
a4d572 |
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
|
|
|
a4d572 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
a4d572 |
Upstream-commit-id: f91e043bda4
|
|
|
a4d572 |
---
|
|
|
a4d572 |
grub-core/lib/LzmaEnc.c | 10 ++++++++--
|
|
|
a4d572 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
a4d572 |
|
|
|
a4d572 |
diff --git a/grub-core/lib/LzmaEnc.c b/grub-core/lib/LzmaEnc.c
|
|
|
a4d572 |
index f2ec04a8c28..753e56a95e3 100644
|
|
|
a4d572 |
--- a/grub-core/lib/LzmaEnc.c
|
|
|
a4d572 |
+++ b/grub-core/lib/LzmaEnc.c
|
|
|
a4d572 |
@@ -1877,13 +1877,19 @@ static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize
|
|
|
a4d572 |
}
|
|
|
a4d572 |
else
|
|
|
a4d572 |
{
|
|
|
a4d572 |
- UInt32 posSlot;
|
|
|
a4d572 |
+ UInt32 posSlot, lenToPosState;
|
|
|
a4d572 |
RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
|
|
|
a4d572 |
p->state = kMatchNextStates[p->state];
|
|
|
a4d572 |
LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
|
|
|
a4d572 |
pos -= LZMA_NUM_REPS;
|
|
|
a4d572 |
GetPosSlot(pos, posSlot);
|
|
|
a4d572 |
- RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot);
|
|
|
a4d572 |
+ lenToPosState = GetLenToPosState(len);
|
|
|
a4d572 |
+ if (lenToPosState >= kNumLenToPosStates)
|
|
|
a4d572 |
+ {
|
|
|
a4d572 |
+ p->result = SZ_ERROR_DATA;
|
|
|
a4d572 |
+ return CheckErrors(p);
|
|
|
a4d572 |
+ }
|
|
|
a4d572 |
+ RcTree_Encode(&p->rc, p->posSlotEncoder[lenToPosState], kNumPosSlotBits, posSlot);
|
|
|
a4d572 |
|
|
|
a4d572 |
if (posSlot >= kStartPosModelIndex)
|
|
|
a4d572 |
{
|