Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-21 14:59:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

video/readers/jpeg: Refuse to handle multiple start of streams

Browse Source 
An invalid file could contain multiple start of stream blocks, which
would cause us to reallocate and leak our bitmap. Refuse to handle
multiple start of streams.

Additionally, fix a grub_error() call formatting.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens authored and Daniel Kiper committed 2022-06-07 16:39:32 +02:00
1 parent 768ef2199e
commit 166a4d6144
1 file changed
+5 -2
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/video/readers/jpeg.c
+5 -2
View File
@@ -683,6 +683,9 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data)
if (data->file->offset != data_offset) if (data->file->offset != data_offset)
return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: extra byte in sos"); return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: extra byte in sos");
if (*data->bitmap)
return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: too many start of scan blocks");
if (grub_video_bitmap_create (data->bitmap, data->image_width, if (grub_video_bitmap_create (data->bitmap, data->image_width,
data->image_height, data->image_height,
GRUB_VIDEO_BLIT_FORMAT_RGB_888)) GRUB_VIDEO_BLIT_FORMAT_RGB_888))
@@ -705,8 +708,8 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data)
nc1 = (data->image_width + hb - 1) >> (3 + data->log_hs); nc1 = (data->image_width + hb - 1) >> (3 + data->log_hs);
if (data->bitmap_ptr == NULL) if (data->bitmap_ptr == NULL)
return grub_error(GRUB_ERR_BAD_FILE_TYPE, return grub_error (GRUB_ERR_BAD_FILE_TYPE,
"jpeg: attempted to decode data before start of stream"); "jpeg: attempted to decode data before start of stream");
for (; data->r1 < nr1 && (!data->dri || rst); for (; data->r1 < nr1 && (!data->dri || rst);
data->r1++, data->bitmap_ptr += (vb * data->image_width - hb * nc1) * 3) data->r1++, data->bitmap_ptr += (vb * data->image_width - hb * nc1) * 3)