1*4882a593SmuzhiyunFrom ae0f3fabeba7b393113d5dc185b6aff9b728136d Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Darren Kenny <darren.kenny@oracle.com> 3*4882a593SmuzhiyunDate: Thu, 26 Nov 2020 10:41:54 +0000 4*4882a593SmuzhiyunSubject: [PATCH] libgcrypt/mpi: Fix possible NULL dereference 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunThe code in gcry_mpi_scan() assumes that buffer is not NULL, but there 7*4882a593Smuzhiyunis no explicit check for that, so we add one. 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunFixes: CID 73757 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunSigned-off-by: Darren Kenny <darren.kenny@oracle.com> 12*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 13*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 14*4882a593Smuzhiyun--- 15*4882a593Smuzhiyun grub-core/lib/libgcrypt-grub/mpi/mpicoder.c | 3 +++ 16*4882a593Smuzhiyun grub-core/lib/libgcrypt/mpi/mpicoder.c | 3 +++ 17*4882a593Smuzhiyun 2 files changed, 6 insertions(+) 18*4882a593Smuzhiyun 19*4882a593Smuzhiyundiff --git a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 20*4882a593Smuzhiyunindex faf1cd6..e734dcf 100644 21*4882a593Smuzhiyun--- a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 22*4882a593Smuzhiyun+++ b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c 23*4882a593Smuzhiyun@@ -381,6 +381,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, 24*4882a593Smuzhiyun unsigned int len; 25*4882a593Smuzhiyun int secure = (buffer && gcry_is_secure (buffer)); 26*4882a593Smuzhiyun 27*4882a593Smuzhiyun+ if (!buffer) 28*4882a593Smuzhiyun+ return gcry_error (GPG_ERR_INV_ARG); 29*4882a593Smuzhiyun+ 30*4882a593Smuzhiyun if (format == GCRYMPI_FMT_SSH) 31*4882a593Smuzhiyun len = 0; 32*4882a593Smuzhiyun else 33*4882a593Smuzhiyundiff --git a/grub-core/lib/libgcrypt/mpi/mpicoder.c b/grub-core/lib/libgcrypt/mpi/mpicoder.c 34*4882a593Smuzhiyunindex 7ecad27..6fe3891 100644 35*4882a593Smuzhiyun--- a/grub-core/lib/libgcrypt/mpi/mpicoder.c 36*4882a593Smuzhiyun+++ b/grub-core/lib/libgcrypt/mpi/mpicoder.c 37*4882a593Smuzhiyun@@ -379,6 +379,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, 38*4882a593Smuzhiyun unsigned int len; 39*4882a593Smuzhiyun int secure = (buffer && gcry_is_secure (buffer)); 40*4882a593Smuzhiyun 41*4882a593Smuzhiyun+ if (!buffer) 42*4882a593Smuzhiyun+ return gcry_error (GPG_ERR_INV_ARG); 43*4882a593Smuzhiyun+ 44*4882a593Smuzhiyun if (format == GCRYMPI_FMT_SSH) 45*4882a593Smuzhiyun len = 0; 46*4882a593Smuzhiyun else 47*4882a593Smuzhiyun-- 48*4882a593Smuzhiyun2.14.2 49*4882a593Smuzhiyun 50