]> git.ipfire.org Git - thirdparty/grub.git/commit
io/gzio: Add init_dynamic_block() clean up if unpacking codes fails
authorDaniel Axtens <dja@axtens.net>
Wed, 20 Jan 2021 13:05:58 +0000 (00:05 +1100)
committerDaniel Kiper <daniel.kiper@oracle.com>
Tue, 2 Mar 2021 14:54:18 +0000 (15:54 +0100)
commit18490336d91da2b532277cba56473bfed1376fc4
treebfec5f4574791a0b21adc5d5788b771ff13934d8
parent3334a5e6c86f10e715cca3bf66ce0fc2f164b61b
io/gzio: Add init_dynamic_block() clean up if unpacking codes fails

init_dynamic_block() didn't clean up gzio->tl and td in some error
paths. This left td pointing to part of tl. Then in grub_gzio_close(),
when tl was freed the storage for td would also be freed. The code then
attempts to free td explicitly, performing a UAF and then a double free.

Explicitly clean up tl and td in the error paths.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/io/gzio.c