| From 8f287c3e13da2bf82049e2e464eca7ca4fef0a85 Mon Sep 17 00:00:00 2001 |
| From: Daniel Axtens <dja@axtens.net> |
| Date: Tue, 18 Jan 2022 14:29:20 +1100 |
| Subject: [PATCH 29/38] net/tftp: Avoid a trivial UAF |
| |
| Under tftp errors, we print a tftp error message from the tftp header. |
| However, the tftph pointer is a pointer inside nb, the netbuff. Previously, |
| we were freeing the nb and then dereferencing it. Don't do that, use it |
| and then free it later. |
| |
| This isn't really _bad_ per se, especially as we're single-threaded, but |
| it trips up fuzzers. |
| |
| Signed-off-by: Daniel Axtens <dja@axtens.net> |
| Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> |
| --- |
| grub-core/net/tftp.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c |
| index ee305e18a..7dbd3056d 100644 |
| --- a/grub-core/net/tftp.c |
| +++ b/grub-core/net/tftp.c |
| @@ -251,9 +251,9 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)), |
| return GRUB_ERR_NONE; |
| case TFTP_ERROR: |
| data->have_oack = 1; |
| - grub_netbuff_free (nb); |
| grub_error (GRUB_ERR_IO, "%s", tftph->u.err.errmsg); |
| grub_error_save (&data->save_err); |
| + grub_netbuff_free (nb); |
| return GRUB_ERR_NONE; |
| default: |
| grub_netbuff_free (nb); |
| -- |
| 2.37.0.rc0.104.g0611611a94-goog |
| |