1From ae0f3fabeba7b393113d5dc185b6aff9b728136d Mon Sep 17 00:00:00 2001 2From: Darren Kenny <darren.kenny@oracle.com> 3Date: Thu, 26 Nov 2020 10:41:54 +0000 4Subject: [PATCH] libgcrypt/mpi: Fix possible NULL dereference 5 6The code in gcry_mpi_scan() assumes that buffer is not NULL, but there 7is no explicit check for that, so we add one. 8 9Fixes: CID 73757 10 11Signed-off-by: Darren Kenny <darren.kenny@oracle.com> 12Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 13Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 14--- 15 grub-core/lib/libgcrypt-grub/mpi/mpicoder.c | 3 +++ 16 grub-core/lib/libgcrypt/mpi/mpicoder.c | 3 +++ 17 2 files changed, 6 insertions(+) 18 19diff --git a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 20index faf1cd6..e734dcf 100644 21--- a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 22+++ b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 23@@ -381,6 +381,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, 24 unsigned int len; 25 int secure = (buffer && gcry_is_secure (buffer)); 26 27+ if (!buffer) 28+ return gcry_error (GPG_ERR_INV_ARG); 29+ 30 if (format == GCRYMPI_FMT_SSH) 31 len = 0; 32 else 33diff --git a/grub-core/lib/libgcrypt/mpi/mpicoder.c b/grub-core/lib/libgcrypt/mpi/mpicoder.c 34index 7ecad27..6fe3891 100644 35--- a/grub-core/lib/libgcrypt/mpi/mpicoder.c 36+++ b/grub-core/lib/libgcrypt/mpi/mpicoder.c 37@@ -379,6 +379,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, 38 unsigned int len; 39 int secure = (buffer && gcry_is_secure (buffer)); 40 41+ if (!buffer) 42+ return gcry_error (GPG_ERR_INV_ARG); 43+ 44 if (format == GCRYMPI_FMT_SSH) 45 len = 0; 46 else 47-- 482.14.2 49 50