From c244e331b9f56f10a67b8b027d6ccab1d45dcadb Mon Sep 17 00:00:00 2001 From: Darren Kenny Date: Tue, 5 Apr 2022 18:25:52 +0000 Subject: [PATCH] video/readers/jpeg: Fix possible invalid loop boundary condition The value of next_marker is adjusted based on the word sized value read from data->file. The updated next_marker value should reference a location in the file just beyond the huffman table, and as such should not have a value larger than the size of the file. Fixes: CID 73657 Signed-off-by: Darren Kenny Reviewed-by: Daniel Kiper --- grub-core/video/readers/jpeg.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c index e31602f76..c47ffd651 100644 --- a/grub-core/video/readers/jpeg.c +++ b/grub-core/video/readers/jpeg.c @@ -199,6 +199,12 @@ grub_jpeg_decode_huff_table (struct grub_jpeg_data *data) next_marker = data->file->offset; next_marker += grub_jpeg_get_word (data); + if (next_marker > data->file->size) + { + return grub_error (GRUB_ERR_BAD_FILE_TYPE, + "jpeg: invalid huffman table"); + } + while (data->file->offset + sizeof (count) + 1 <= next_marker) { id = grub_jpeg_get_byte (data); -- 2.47.2