projects / grub2.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 22c4e3f) | patch
video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG
authorDaniel Axtens <dja@axtens.net>
Fri, 8 Mar 2024 11:47:20 +0000 (22:47 +1100)
committerFelix Zielcke <fzielcke@z-51.de>
Wed, 11 Jun 2025 15:42:34 +0000 (17:42 +0200)
commit47cb2349da8bf9bb4322ba2b64a2e42d50876b59
tree32e42fe0acca61290669061235651ee946f2c0c4tree | snapshot
parent22c4e3fb0b70095cde1227feb8ae7fda571b5a81commit | diff
video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG

Otherwise a subsequent header could change the height and width
allowing future OOB writes.

Fixes: CVE-2024-45774
Reported-by: Nils Langius <nils@langius.de>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name video-readers-jpeg-Do-not-permit-duplicate-SOF0-markers-i.patch
grub-core/video/readers/jpeg.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.