1From 693989598fd38c3c0b2a928f4f64865b5681762f Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Fri, 15 Jan 2021 12:57:04 +1100
4Subject: [PATCH] video/readers/jpeg: Catch files with unsupported quantization
5 or Huffman tables
6
7Our decoder only supports 2 quantization tables. If a file asks for
8a quantization table with index > 1, reject it.
9
10Similarly, our decoder only supports 4 Huffman tables. If a file asks
11for a Huffman table with index > 3, reject it.
12
13This fixes some out of bounds reads. It's not clear what degree of control
14over subsequent execution could be gained by someone who can carefully
15set up the contents of memory before loading an invalid JPEG file.
16
17Signed-off-by: Daniel Axtens <dja@axtens.net>
18Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
19Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
20---
21 grub-core/video/readers/jpeg.c | 8 ++++++++
22 1 file changed, 8 insertions(+)
23
24diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
25index 0b6ce3c..23f919a 100644
26--- a/grub-core/video/readers/jpeg.c
27+++ b/grub-core/video/readers/jpeg.c
28@@ -333,7 +333,11 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
29       else if (ss != JPEG_SAMPLING_1x1)
30 	return grub_error (GRUB_ERR_BAD_FILE_TYPE,
31 			   "jpeg: sampling method not supported");
32+
33       data->comp_index[id][0] = grub_jpeg_get_byte (data);
34+      if (data->comp_index[id][0] > 1)
35+	return grub_error (GRUB_ERR_BAD_FILE_TYPE,
36+			   "jpeg: too many quantization tables");
37     }
38
39   if (data->file->offset != next_marker)
40@@ -602,6 +606,10 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data)
41       ht = grub_jpeg_get_byte (data);
42       data->comp_index[id][1] = (ht >> 4);
43       data->comp_index[id][2] = (ht & 0xF) + 2;
44+
45+      if ((data->comp_index[id][1] < 0) || (data->comp_index[id][1] > 3) ||
46+	  (data->comp_index[id][2] < 0) || (data->comp_index[id][2] > 3))
47+	return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid hufftable index");
48     }
49
50   grub_jpeg_get_byte (data);	/* Skip 3 unused bytes.  */
51--
522.14.2
53
54