1From 8b6f528e52e18b7a69f90b8dc3671d7b1147d9f3 Mon Sep 17 00:00:00 2001 2From: Chris Coulson <chris.coulson@canonical.com> 3Date: Tue, 1 Dec 2020 23:41:24 +0000 4Subject: [PATCH] commands/hashsum: Fix a memory leak 5 6check_list() uses grub_file_getline(), which allocates a buffer. 7If the hash list file contains invalid lines, the function leaks 8this buffer when it returns an error. 9 10Fixes: CID 176635 11 12Signed-off-by: Chris Coulson <chris.coulson@canonical.com> 13Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 14Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 15--- 16 grub-core/commands/hashsum.c | 15 ++++++++++++--- 17 1 file changed, 12 insertions(+), 3 deletions(-) 18 19diff --git a/grub-core/commands/hashsum.c b/grub-core/commands/hashsum.c 20index 456ba90..b8a22b0 100644 21--- a/grub-core/commands/hashsum.c 22+++ b/grub-core/commands/hashsum.c 23@@ -128,11 +128,17 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename, 24 high = hextoval (*p++); 25 low = hextoval (*p++); 26 if (high < 0 || low < 0) 27- return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); 28+ { 29+ grub_free (buf); 30+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); 31+ } 32 expected[i] = (high << 4) | low; 33 } 34 if ((p[0] != ' ' && p[0] != '\t') || (p[1] != ' ' && p[1] != '\t')) 35- return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); 36+ { 37+ grub_free (buf); 38+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); 39+ } 40 p += 2; 41 if (prefix) 42 { 43@@ -140,7 +146,10 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename, 44 45 filename = grub_xasprintf ("%s/%s", prefix, p); 46 if (!filename) 47- return grub_errno; 48+ { 49+ grub_free (buf); 50+ return grub_errno; 51+ } 52 file = grub_file_open (filename, GRUB_FILE_TYPE_TO_HASH 53 | (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS 54 : GRUB_FILE_TYPE_NONE)); 55-- 562.14.2 57 58