]> dgit.raspbian.org Git - grub2.git/commit
projects / grub2.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2d47537) | patch
video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG
authorDaniel Axtens <dja@axtens.net>
Fri, 8 Mar 2024 11:47:20 +0000 (22:47 +1100)
committerAurelien Jarno <aurel32@debian.org>
Thu, 30 Apr 2026 19:02:01 +0000 (21:02 +0200)
commit355d2077d2e0575da0e560077fcb68de83909b0c
tree197dea74aa5dc21ddc07b8c58d77ce5f90152fa5tree | snapshot
parent2d47537ec2675a2ef501c0e9e90e4b94c25ba99acommit | diff
video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG

Otherwise a subsequent header could change the height and width
allowing future OOB writes.

Fixes: CVE-2024-45774
Reported-by: Nils Langius <nils@langius.de>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name video-readers-jpeg-Do-not-permit-duplicate-SOF0-markers-i.patch
grub-core/video/readers/jpeg.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.