proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-07-16 16:43:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

commands/hashsum: Fix a memory leak

Browse Source 
check_list() uses grub_file_getline(), which allocates a buffer.
If the hash list file contains invalid lines, the function leaks
this buffer when it returns an error.

Fixes: CID 176635

Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Chris Coulson 2020-12-01 23:41:24 +00:00 committed by Daniel Kiper
parent 9213575b7a
commit 8b6f528e52
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
grub-core/commands/hashsum.c
View File

@ -128,11 +128,17 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename,
high = hextoval (*p++); high = hextoval (*p++);
low = hextoval (*p++); low = hextoval (*p++);
if (high < 0 || low < 0) if (high < 0 || low < 0)
return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); {
grub_free (buf);
return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
}
expected[i] = (high << 4) | low; expected[i] = (high << 4) | low;
} }
if ((p[0] != ' ' && p[0] != '\t') || (p[1] != ' ' && p[1] != '\t')) if ((p[0] != ' ' && p[0] != '\t') || (p[1] != ' ' && p[1] != '\t'))
return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); {
grub_free (buf);
return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list");
}
p += 2; p += 2;
if (prefix) if (prefix)
{ {
@ -140,7 +146,10 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename,
filename = grub_xasprintf ("%s/%s", prefix, p); filename = grub_xasprintf ("%s/%s", prefix, p);
if (!filename) if (!filename)
return grub_errno; {
grub_free (buf);
return grub_errno;
}
file = grub_file_open (filename, GRUB_FILE_TYPE_TO_HASH file = grub_file_open (filename, GRUB_FILE_TYPE_TO_HASH
| (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS | (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS
: GRUB_FILE_TYPE_NONE)); : GRUB_FILE_TYPE_NONE));