1*4882a593SmuzhiyunFrom 18490336d91da2b532277cba56473bfed1376fc4 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Daniel Axtens <dja@axtens.net> 3*4882a593SmuzhiyunDate: Thu, 21 Jan 2021 00:05:58 +1100 4*4882a593SmuzhiyunSubject: [PATCH] io/gzio: Add init_dynamic_block() clean up if unpacking codes 5*4882a593Smuzhiyun fails 6*4882a593Smuzhiyun 7*4882a593Smuzhiyuninit_dynamic_block() didn't clean up gzio->tl and td in some error 8*4882a593Smuzhiyunpaths. This left td pointing to part of tl. Then in grub_gzio_close(), 9*4882a593Smuzhiyunwhen tl was freed the storage for td would also be freed. The code then 10*4882a593Smuzhiyunattempts to free td explicitly, performing a UAF and then a double free. 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunExplicitly clean up tl and td in the error paths. 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunSigned-off-by: Daniel Axtens <dja@axtens.net> 15*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 16*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 17*4882a593Smuzhiyun--- 18*4882a593Smuzhiyun grub-core/io/gzio.c | 12 +++++++++--- 19*4882a593Smuzhiyun 1 file changed, 9 insertions(+), 3 deletions(-) 20*4882a593Smuzhiyun 21*4882a593Smuzhiyundiff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c 22*4882a593Smuzhiyunindex 4a8eaea..4236f0f 100644 23*4882a593Smuzhiyun--- a/grub-core/io/gzio.c 24*4882a593Smuzhiyun+++ b/grub-core/io/gzio.c 25*4882a593Smuzhiyun@@ -953,7 +953,7 @@ init_dynamic_block (grub_gzio_t gzio) 26*4882a593Smuzhiyun if ((unsigned) i + j > n) 27*4882a593Smuzhiyun { 28*4882a593Smuzhiyun grub_error (GRUB_ERR_BAD_COMPRESSED_DATA, "too many codes found"); 29*4882a593Smuzhiyun- return; 30*4882a593Smuzhiyun+ goto fail; 31*4882a593Smuzhiyun } 32*4882a593Smuzhiyun while (j--) 33*4882a593Smuzhiyun ll[i++] = l; 34*4882a593Smuzhiyun@@ -966,7 +966,7 @@ init_dynamic_block (grub_gzio_t gzio) 35*4882a593Smuzhiyun if ((unsigned) i + j > n) 36*4882a593Smuzhiyun { 37*4882a593Smuzhiyun grub_error (GRUB_ERR_BAD_COMPRESSED_DATA, "too many codes found"); 38*4882a593Smuzhiyun- return; 39*4882a593Smuzhiyun+ goto fail; 40*4882a593Smuzhiyun } 41*4882a593Smuzhiyun while (j--) 42*4882a593Smuzhiyun ll[i++] = 0; 43*4882a593Smuzhiyun@@ -981,7 +981,7 @@ init_dynamic_block (grub_gzio_t gzio) 44*4882a593Smuzhiyun if ((unsigned) i + j > n) 45*4882a593Smuzhiyun { 46*4882a593Smuzhiyun grub_error (GRUB_ERR_BAD_COMPRESSED_DATA, "too many codes found"); 47*4882a593Smuzhiyun- return; 48*4882a593Smuzhiyun+ goto fail; 49*4882a593Smuzhiyun } 50*4882a593Smuzhiyun while (j--) 51*4882a593Smuzhiyun ll[i++] = 0; 52*4882a593Smuzhiyun@@ -1019,6 +1019,12 @@ init_dynamic_block (grub_gzio_t gzio) 53*4882a593Smuzhiyun /* indicate we're now working on a block */ 54*4882a593Smuzhiyun gzio->code_state = 0; 55*4882a593Smuzhiyun gzio->block_len++; 56*4882a593Smuzhiyun+ return; 57*4882a593Smuzhiyun+ 58*4882a593Smuzhiyun+ fail: 59*4882a593Smuzhiyun+ huft_free (gzio->tl); 60*4882a593Smuzhiyun+ gzio->td = NULL; 61*4882a593Smuzhiyun+ gzio->tl = NULL; 62*4882a593Smuzhiyun } 63*4882a593Smuzhiyun 64*4882a593Smuzhiyun 65*4882a593Smuzhiyun-- 66*4882a593Smuzhiyun2.14.2 67*4882a593Smuzhiyun 68