proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-07-27 06:30:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

io/gzio: Catch missing values in huft_build() and bail

Browse Source 
In huft_build(), "v" is a table of values in order of bit length.
The code later (when setting up table entries in "r") assumes that all
elements of this array corresponding to a code are initialized and less
than N_MAX. However, it doesn't enforce this.

With sufficiently manipulated inputs (e.g. from fuzzing), there can be
elements of "v" that are not filled. Therefore a lookup into "e" or "d"
will use an uninitialized value. This can lead to an invalid/OOB read on
those values, often leading to a crash.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens 2021-01-21 12:20:49 +11:00 committed by Daniel Kiper
parent 18490336d9
commit 4e76b08f71
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
grub-core/io/gzio.c
View File

@ -507,6 +507,7 @@ huft_build (unsigned *b, /* code lengths in bits (all assumed <= BMAX) */
} }
/* Make a table of values in order of bit lengths */ /* Make a table of values in order of bit lengths */
grub_memset (v, N_MAX, ARRAY_SIZE (v));
p = b; p = b;
i = 0; i = 0;
do do
@ -588,11 +589,18 @@ huft_build (unsigned *b, /* code lengths in bits (all assumed <= BMAX) */
r.v.n = (ush) (*p); /* simple code is just the value */ r.v.n = (ush) (*p); /* simple code is just the value */
p++; /* one compiler does not like *p++ */ p++; /* one compiler does not like *p++ */
} }
else else if (*p < N_MAX)
{ {
r.e = (uch) e[*p - s]; /* non-simple--look up in lists */ r.e = (uch) e[*p - s]; /* non-simple--look up in lists */
r.v.n = d[*p++ - s]; r.v.n = d[*p++ - s];
} }
else
{
/* Detected an uninitialised value, abort. */
if (h)
huft_free (u[0]);
return 2;
}
/* fill code-like entries with r */ /* fill code-like entries with r */
f = 1 << (k - w); f = 1 << (k - w);