Z572/grub
1
0
Fork 0
mirror of http://cgit.git.savannah.gnu.org/git/grub.git synced 2026-04-28 06:33:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG

Browse Source 
Otherwise a subsequent header could change the height and width
allowing future OOB writes.

Fixes: CVE-2024-45774

Reported-by: Nils Langius <nils@langius.de>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens
2024-03-08 22:47:20 +11:00
committed by Daniel Kiper
parent 0707accab1
commit 2c34af908e
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
grub-core/video/readers/jpeg.c
View File

@@ -339,6 +339,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
if (grub_errno != GRUB_ERR_NONE)
return grub_errno;
if (data->image_height != 0 || data->image_width != 0)
return grub_error (GRUB_ERR_BAD_FILE_TYPE,
"jpeg: cannot have duplicate SOF0 markers");
if (grub_jpeg_get_byte (data) != 8)
return grub_error (GRUB_ERR_BAD_FILE_TYPE,
"jpeg: only 8-bit precision is supported");