|
 |
b1bcb2 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b1bcb2 |
From: Daniel Axtens <dja@axtens.net>
|
|
|
b1bcb2 |
Date: Fri, 15 Jan 2021 14:06:46 +1100
|
|
|
b1bcb2 |
Subject: [PATCH] video/readers/jpeg: Don't decode data before start of stream
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
When a start of stream marker is encountered, we call grub_jpeg_decode_sos()
|
|
|
b1bcb2 |
which allocates space for a bitmap.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
When a restart marker is encountered, we call grub_jpeg_decode_data() which
|
|
|
b1bcb2 |
then fills in that bitmap.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
If we get a restart marker before the start of stream marker, we will
|
|
|
b1bcb2 |
attempt to write to a bitmap_ptr that hasn't been allocated. Catch this
|
|
|
b1bcb2 |
and bail out. This fixes an attempt to write to NULL.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
|
b1bcb2 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b1bcb2 |
---
|
|
|
b1bcb2 |
grub-core/video/readers/jpeg.c | 4 ++++
|
|
|
b1bcb2 |
1 file changed, 4 insertions(+)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
|
|
|
b1bcb2 |
index 2cbbb467ebb..a6742a96b13 100644
|
|
|
b1bcb2 |
--- a/grub-core/video/readers/jpeg.c
|
|
|
b1bcb2 |
+++ b/grub-core/video/readers/jpeg.c
|
|
|
b1bcb2 |
@@ -643,6 +643,10 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data)
|
|
|
b1bcb2 |
nr1 = (data->image_height + vb - 1) / vb;
|
|
|
b1bcb2 |
nc1 = (data->image_width + hb - 1) / hb;
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
+ if (data->bitmap_ptr == NULL)
|
|
|
b1bcb2 |
+ return grub_error(GRUB_ERR_BAD_FILE_TYPE,
|
|
|
b1bcb2 |
+ "jpeg: attempted to decode data before start of stream");
|
|
|
b1bcb2 |
+
|
|
|
b1bcb2 |
for (; data->r1 < nr1 && (!data->dri || rst);
|
|
|
b1bcb2 |
data->r1++, data->bitmap_ptr += (vb * data->image_width - hb * nc1) * 3)
|
|
|
b1bcb2 |
for (c1 = 0; c1 < nc1 && (!data->dri || rst);
|