From ae0f3fabeba7b393113d5dc185b6aff9b728136d Mon Sep 17 00:00:00 2001 From: Darren Kenny Date: Thu, 26 Nov 2020 10:41:54 +0000 Subject: [PATCH] libgcrypt/mpi: Fix possible NULL dereference The code in gcry_mpi_scan() assumes that buffer is not NULL, but there is no explicit check for that, so we add one. Fixes: CID 73757 Signed-off-by: Darren Kenny Reviewed-by: Daniel Kiper Signed-off-by: Stefan Sørensen --- grub-core/lib/libgcrypt-grub/mpi/mpicoder.c | 3 +++ grub-core/lib/libgcrypt/mpi/mpicoder.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c index faf1cd6..e734dcf 100644 --- a/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c +++ b/grub-core/lib/libgcrypt-grub/mpi/mpicoder.c @@ -381,6 +381,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, unsigned int len; int secure = (buffer && gcry_is_secure (buffer)); + if (!buffer) + return gcry_error (GPG_ERR_INV_ARG); + if (format == GCRYMPI_FMT_SSH) len = 0; else diff --git a/grub-core/lib/libgcrypt/mpi/mpicoder.c b/grub-core/lib/libgcrypt/mpi/mpicoder.c index 7ecad27..6fe3891 100644 --- a/grub-core/lib/libgcrypt/mpi/mpicoder.c +++ b/grub-core/lib/libgcrypt/mpi/mpicoder.c @@ -379,6 +379,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, unsigned int len; int secure = (buffer && gcry_is_secure (buffer)); + if (!buffer) + return gcry_error (GPG_ERR_INV_ARG); + if (format == GCRYMPI_FMT_SSH) len = 0; else -- 2.14.2