1*4882a593SmuzhiyunFrom 34b85a6e07014383ddcad09f99ff239ad752dd1a Mon Sep 17 00:00:00 2001
2*4882a593SmuzhiyunFrom: Daniel Axtens <dja@axtens.net>
3*4882a593SmuzhiyunDate: Fri, 15 Jan 2021 13:29:53 +1100
4*4882a593SmuzhiyunSubject: [PATCH] video/readers/jpeg: Catch OOB reads/writes in
5*4882a593Smuzhiyun grub_jpeg_decode_du()
6*4882a593Smuzhiyun
7*4882a593SmuzhiyunThe key line is:
8*4882a593Smuzhiyun
9*4882a593Smuzhiyun  du[jpeg_zigzag_order[pos]] = val * (int) data->quan_table[qt][pos];
10*4882a593Smuzhiyun
11*4882a593Smuzhiyunjpeg_zigzag_order is grub_uint8_t[64].
12*4882a593Smuzhiyun
13*4882a593SmuzhiyunI don't understand JPEG decoders quite well enough to explain what's
14*4882a593Smuzhiyungoing on here. However, I observe sometimes pos=64, which leads to an
15*4882a593SmuzhiyunOOB read of the jpeg_zigzag_order global then an OOB write to du.
16*4882a593SmuzhiyunThat leads to various unpleasant memory corruption conditions.
17*4882a593Smuzhiyun
18*4882a593SmuzhiyunCatch where pos >= ARRAY_SIZE(jpeg_zigzag_order) and bail.
19*4882a593Smuzhiyun
20*4882a593SmuzhiyunSigned-off-by: Daniel Axtens <dja@axtens.net>
21*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
22*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
23*4882a593Smuzhiyun---
24*4882a593Smuzhiyun grub-core/video/readers/jpeg.c | 8 ++++++++
25*4882a593Smuzhiyun 1 file changed, 8 insertions(+)
26*4882a593Smuzhiyun
27*4882a593Smuzhiyundiff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
28*4882a593Smuzhiyunindex 23f919a..e514812 100644
29*4882a593Smuzhiyun--- a/grub-core/video/readers/jpeg.c
30*4882a593Smuzhiyun+++ b/grub-core/video/readers/jpeg.c
31*4882a593Smuzhiyun@@ -526,6 +526,14 @@ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du)
32*4882a593Smuzhiyun       val = grub_jpeg_get_number (data, num & 0xF);
33*4882a593Smuzhiyun       num >>= 4;
34*4882a593Smuzhiyun       pos += num;
35*4882a593Smuzhiyun+
36*4882a593Smuzhiyun+      if (pos >= ARRAY_SIZE (jpeg_zigzag_order))
37*4882a593Smuzhiyun+	{
38*4882a593Smuzhiyun+	  grub_error (GRUB_ERR_BAD_FILE_TYPE,
39*4882a593Smuzhiyun+		      "jpeg: invalid position in zigzag order!?");
40*4882a593Smuzhiyun+	  return;
41*4882a593Smuzhiyun+	}
42*4882a593Smuzhiyun+
43*4882a593Smuzhiyun       du[jpeg_zigzag_order[pos]] = val * (int) data->quan_table[qt][pos];
44*4882a593Smuzhiyun       pos++;
45*4882a593Smuzhiyun     }
46*4882a593Smuzhiyun--
47*4882a593Smuzhiyun2.14.2
48*4882a593Smuzhiyun
49