* [PATCH 1/1] jpeg: Fix possible invalid loop boundary condition
@ 2022-04-05 18:25 Darren Kenny
2022-04-07 14:30 ` Daniel Kiper
0 siblings, 1 reply; 2+ messages in thread
From: Darren Kenny @ 2022-04-05 18:25 UTC (permalink / raw)
To: grub-devel; +Cc: darren.kenny
The value of next_marker is adjusted based on the a word sized value
read from data->file.
The updated next_marker value should reference a location in the file
just beyond the huffman table, and as such should not have a value
larger than the size of the file.
Fixes: CID 73657
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
---
grub-core/video/readers/jpeg.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
index e31602f766ae..c47ffd65151e 100644
--- a/grub-core/video/readers/jpeg.c
+++ b/grub-core/video/readers/jpeg.c
@@ -199,6 +199,12 @@ grub_jpeg_decode_huff_table (struct grub_jpeg_data *data)
next_marker = data->file->offset;
next_marker += grub_jpeg_get_word (data);
+ if (next_marker > data->file->size)
+ {
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+ "jpeg: invalid huffman table");
+ }
+
while (data->file->offset + sizeof (count) + 1 <= next_marker)
{
id = grub_jpeg_get_byte (data);
--
2.27.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 1/1] jpeg: Fix possible invalid loop boundary condition
2022-04-05 18:25 [PATCH 1/1] jpeg: Fix possible invalid loop boundary condition Darren Kenny
@ 2022-04-07 14:30 ` Daniel Kiper
0 siblings, 0 replies; 2+ messages in thread
From: Daniel Kiper @ 2022-04-07 14:30 UTC (permalink / raw)
To: Darren Kenny; +Cc: grub-devel
On Tue, Apr 05, 2022 at 06:25:52PM +0000, Darren Kenny wrote:
> The value of next_marker is adjusted based on the a word sized value
> read from data->file.
>
> The updated next_marker value should reference a location in the file
> just beyond the huffman table, and as such should not have a value
> larger than the size of the file.
>
> Fixes: CID 73657
>
> Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Daniel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-04-07 14:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-05 18:25 [PATCH 1/1] jpeg: Fix possible invalid loop boundary condition Darren Kenny
2022-04-07 14:30 ` Daniel Kiper
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.