1From d5caac8ab79d068ad9a41030c772d03a4d4fbd7b Mon Sep 17 00:00:00 2001 2From: Daniel Axtens <dja@axtens.net> 3Date: Mon, 28 Jun 2021 14:16:14 +1000 4Subject: [PATCH] video/readers/jpeg: Abort sooner if a read operation fails 5 6Fuzzing revealed some inputs that were taking a long time, potentially 7forever, because they did not bail quickly upon encountering an I/O error. 8 9Try to catch I/O errors sooner and bail out. 10 11Signed-off-by: Daniel Axtens <dja@axtens.net> 12Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 13 14Upstream-Status: Backport 15 16Reference to upstream patch: 17https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d5caac8ab79d068ad9a41030c772d03a4d4fbd7b 18 19Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com> 20--- 21 grub-core/video/readers/jpeg.c | 86 +++++++++++++++++++++++++++------- 22 1 file changed, 70 insertions(+), 16 deletions(-) 23 24diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c 25index c47ffd651..806c56c78 100644 26--- a/grub-core/video/readers/jpeg.c 27+++ b/grub-core/video/readers/jpeg.c 28@@ -109,9 +109,17 @@ static grub_uint8_t 29 grub_jpeg_get_byte (struct grub_jpeg_data *data) 30 { 31 grub_uint8_t r; 32+ grub_ssize_t bytes_read; 33 34 r = 0; 35- grub_file_read (data->file, &r, 1); 36+ bytes_read = grub_file_read (data->file, &r, 1); 37+ 38+ if (bytes_read != 1) 39+ { 40+ grub_error (GRUB_ERR_BAD_FILE_TYPE, 41+ "jpeg: unexpected end of data"); 42+ return 0; 43+ } 44 45 return r; 46 } 47@@ -120,9 +128,17 @@ static grub_uint16_t 48 grub_jpeg_get_word (struct grub_jpeg_data *data) 49 { 50 grub_uint16_t r; 51+ grub_ssize_t bytes_read; 52 53 r = 0; 54- grub_file_read (data->file, &r, sizeof (grub_uint16_t)); 55+ bytes_read = grub_file_read (data->file, &r, sizeof (grub_uint16_t)); 56+ 57+ if (bytes_read != sizeof (grub_uint16_t)) 58+ { 59+ grub_error (GRUB_ERR_BAD_FILE_TYPE, 60+ "jpeg: unexpected end of data"); 61+ return 0; 62+ } 63 64 return grub_be_to_cpu16 (r); 65 } 66@@ -135,6 +151,11 @@ grub_jpeg_get_bit (struct grub_jpeg_data *data) 67 if (data->bit_mask == 0) 68 { 69 data->bit_save = grub_jpeg_get_byte (data); 70+ if (grub_errno != GRUB_ERR_NONE) { 71+ grub_error (GRUB_ERR_BAD_FILE_TYPE, 72+ "jpeg: file read error"); 73+ return 0; 74+ } 75 if (data->bit_save == JPEG_ESC_CHAR) 76 { 77 if (grub_jpeg_get_byte (data) != 0) 78@@ -143,6 +164,11 @@ grub_jpeg_get_bit (struct grub_jpeg_data *data) 79 "jpeg: invalid 0xFF in data stream"); 80 return 0; 81 } 82+ if (grub_errno != GRUB_ERR_NONE) 83+ { 84+ grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: file read error"); 85+ return 0; 86+ } 87 } 88 data->bit_mask = 0x80; 89 } 90@@ -161,7 +187,7 @@ grub_jpeg_get_number (struct grub_jpeg_data *data, int num) 91 return 0; 92 93 msb = value = grub_jpeg_get_bit (data); 94- for (i = 1; i < num; i++) 95+ for (i = 1; i < num && grub_errno == GRUB_ERR_NONE; i++) 96 value = (value << 1) + (grub_jpeg_get_bit (data) != 0); 97 if (!msb) 98 value += 1 - (1 << num); 99@@ -208,6 +234,8 @@ grub_jpeg_decode_huff_table (struct grub_jpeg_data *data) 100 while (data->file->offset + sizeof (count) + 1 <= next_marker) 101 { 102 id = grub_jpeg_get_byte (data); 103+ if (grub_errno != GRUB_ERR_NONE) 104+ return grub_errno; 105 ac = (id >> 4) & 1; 106 id &= 0xF; 107 if (id > 1) 108@@ -258,6 +286,8 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data) 109 110 next_marker = data->file->offset; 111 next_marker += grub_jpeg_get_word (data); 112+ if (grub_errno != GRUB_ERR_NONE) 113+ return grub_errno; 114 115 if (next_marker > data->file->size) 116 { 117@@ -269,6 +299,8 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data) 118 <= next_marker) 119 { 120 id = grub_jpeg_get_byte (data); 121+ if (grub_errno != GRUB_ERR_NONE) 122+ return grub_errno; 123 if (id >= 0x10) /* Upper 4-bit is precision. */ 124 return grub_error (GRUB_ERR_BAD_FILE_TYPE, 125 "jpeg: only 8-bit precision is supported"); 126@@ -300,6 +332,9 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data) 127 next_marker = data->file->offset; 128 next_marker += grub_jpeg_get_word (data); 129 130+ if (grub_errno != GRUB_ERR_NONE) 131+ return grub_errno; 132+ 133 if (grub_jpeg_get_byte (data) != 8) 134 return grub_error (GRUB_ERR_BAD_FILE_TYPE, 135 "jpeg: only 8-bit precision is supported"); 136@@ -325,6 +360,8 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data) 137 return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid index"); 138 139 ss = grub_jpeg_get_byte (data); /* Sampling factor. */ 140+ if (grub_errno != GRUB_ERR_NONE) 141+ return grub_errno; 142 if (!id) 143 { 144 grub_uint8_t vs, hs; 145@@ -504,7 +541,7 @@ grub_jpeg_idct_transform (jpeg_data_unit_t du) 146 } 147 } 148 149-static void 150+static grub_err_t 151 grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du) 152 { 153 int h1, h2, qt; 154@@ -519,6 +556,9 @@ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du) 155 data->dc_value[id] += 156 grub_jpeg_get_number (data, grub_jpeg_get_huff_code (data, h1)); 157 158+ if (grub_errno != GRUB_ERR_NONE) 159+ return grub_errno; 160+ 161 du[0] = data->dc_value[id] * (int) data->quan_table[qt][0]; 162 pos = 1; 163 while (pos < ARRAY_SIZE (data->quan_table[qt])) 164@@ -533,11 +573,13 @@ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du) 165 num >>= 4; 166 pos += num; 167 168+ if (grub_errno != GRUB_ERR_NONE) 169+ return grub_errno; 170+ 171 if (pos >= ARRAY_SIZE (jpeg_zigzag_order)) 172 { 173- grub_error (GRUB_ERR_BAD_FILE_TYPE, 174- "jpeg: invalid position in zigzag order!?"); 175- return; 176+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, 177+ "jpeg: invalid position in zigzag order!?"); 178 } 179 180 du[jpeg_zigzag_order[pos]] = val * (int) data->quan_table[qt][pos]; 181@@ -545,6 +587,7 @@ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du) 182 } 183 184 grub_jpeg_idct_transform (du); 185+ return GRUB_ERR_NONE; 186 } 187 188 static void 189@@ -603,7 +646,8 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data) 190 data_offset += grub_jpeg_get_word (data); 191 192 cc = grub_jpeg_get_byte (data); 193- 194+ if (grub_errno != GRUB_ERR_NONE) 195+ return grub_errno; 196 if (cc != 3 && cc != 1) 197 return grub_error (GRUB_ERR_BAD_FILE_TYPE, 198 "jpeg: component count must be 1 or 3"); 199@@ -616,7 +660,8 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data) 200 id = grub_jpeg_get_byte (data) - 1; 201 if ((id < 0) || (id >= 3)) 202 return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid index"); 203- 204+ if (grub_errno != GRUB_ERR_NONE) 205+ return grub_errno; 206 ht = grub_jpeg_get_byte (data); 207 data->comp_index[id][1] = (ht >> 4); 208 data->comp_index[id][2] = (ht & 0xF) + 2; 209@@ -624,11 +669,14 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data) 210 if ((data->comp_index[id][1] < 0) || (data->comp_index[id][1] > 3) || 211 (data->comp_index[id][2] < 0) || (data->comp_index[id][2] > 3)) 212 return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid hufftable index"); 213+ if (grub_errno != GRUB_ERR_NONE) 214+ return grub_errno; 215 } 216 217 grub_jpeg_get_byte (data); /* Skip 3 unused bytes. */ 218 grub_jpeg_get_word (data); 219- 220+ if (grub_errno != GRUB_ERR_NONE) 221+ return grub_errno; 222 if (data->file->offset != data_offset) 223 return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: extra byte in sos"); 224 225@@ -646,6 +694,7 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data) 226 { 227 unsigned c1, vb, hb, nr1, nc1; 228 int rst = data->dri; 229+ grub_err_t err = GRUB_ERR_NONE; 230 231 vb = 8 << data->log_vs; 232 hb = 8 << data->log_hs; 233@@ -666,17 +715,22 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data) 234 235 for (r2 = 0; r2 < (1U << data->log_vs); r2++) 236 for (c2 = 0; c2 < (1U << data->log_hs); c2++) 237- grub_jpeg_decode_du (data, 0, data->ydu[r2 * 2 + c2]); 238+ { 239+ err = grub_jpeg_decode_du (data, 0, data->ydu[r2 * 2 + c2]); 240+ if (err != GRUB_ERR_NONE) 241+ return err; 242+ } 243 244 if (data->color_components >= 3) 245 { 246- grub_jpeg_decode_du (data, 1, data->cbdu); 247- grub_jpeg_decode_du (data, 2, data->crdu); 248+ err = grub_jpeg_decode_du (data, 1, data->cbdu); 249+ if (err != GRUB_ERR_NONE) 250+ return err; 251+ err = grub_jpeg_decode_du (data, 2, data->crdu); 252+ if (err != GRUB_ERR_NONE) 253+ return err; 254 } 255 256- if (grub_errno) 257- return grub_errno; 258- 259 nr2 = (data->r1 == nr1 - 1) ? (data->image_height - data->r1 * vb) : vb; 260 nc2 = (c1 == nc1 - 1) ? (data->image_width - c1 * hb) : hb; 261 262-- 2632.34.1 264 265