From: Daniel Axtens Date: Fri, 8 Mar 2024 11:47:20 +0000 (+1100) Subject: video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2c34af908ebf4856051ed29e46d88abd2b20387f;p=thirdparty%2Fgrub.git video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG Otherwise a subsequent header could change the height and width allowing future OOB writes. Fixes: CVE-2024-45774 Reported-by: Nils Langius Signed-off-by: Daniel Axtens Reviewed-by: Daniel Kiper --- diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c index ae634fd41..631a89356 100644 --- a/grub-core/video/readers/jpeg.c +++ b/grub-core/video/readers/jpeg.c @@ -339,6 +339,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data) if (grub_errno != GRUB_ERR_NONE) return grub_errno; + if (data->image_height != 0 || data->image_width != 0) + return grub_error (GRUB_ERR_BAD_FILE_TYPE, + "jpeg: cannot have duplicate SOF0 markers"); + if (grub_jpeg_get_byte (data) != 8) return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: only 8-bit precision is supported");